hxxps://chomikuj[.]pl/maciusplay042/watykanczyk,9102098989[.]exe(executable)

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	cscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 3 IoCs

pid	Process
5888	FreeRobux_Gen.exe
2008	ST_0.1.exe
7492	watykanczyk.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
6488	tasklist.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_1931731229\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_1931731229\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_1931731229\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_1931731229\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_1881126265\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_1881126265\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_1881126265\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4636_1881126265\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeRobux_Gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ielowutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ST_0.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	watykanczyk.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
1752	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
708	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
6416	ipconfig.exe
6408	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b630000000002000000000010660000000100002000000059a04ab5d603fee8e763a63f5390140421a8cdae90a2d015104a604da2513c22000000000e800000000200002000000030f87bbe9a8982cc1ce4b0130c9ff6e8a9e96defb82784551ca53de34e8c909d10010000ce11cccfe820aae871ba5c08672b8f874fa590271bee843d9c97414ed633be574c73735fe7807a79e6a0044e57b878707f9e5cbd3599af0a9d144ca81a37de9d558ba10e09c1586f055556107b7ad89651af7cf67847cb78c862ca0389d0b5e6fa58323915999dc07e24d4b073538b6a8cb1e1a78bbfc8826ca0961684649495b87a356b17528da8d233a44391769a123c214684c3772a2a1f6489f269270ff93c9fe756509526643b146111df8e05eb934a1ba2063bed816056dd06bb7c5eac5815a732f3f4c0f858816b8130285b95659ddbc0123f3292a5152d6a5aae76b497e2caff8351daa67d32ef128bad43603959576f8f56a8d294aa252e681265507ac98ebb4d68f7c24a47758f142fb34c40000000014cc313eaf7cdcc8ef3b644b6e2957099248df6c6bdc5cbe158cb444887f0fbb2a035afa32bad7f7373485f8d8eae8bbf446a915efd968857f0b9412951a75a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31248233"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b63000000000200000000001066000000010000200000002d266dafc51ee71bec00566d4d6d94fab50aad14e52855cc51b9927a96529b1f000000000e800000000200002000000099ecc435defed00caa6636bc6b7c290a18c9e329b1fddd99d98fb1bfb1c5050c10010000922d1b2a295b854bec85a659627ce7b67223a0c8ef50ee421a618a9131877d672e31a37db0b398a97a66df81e5affe41d9fabeb27d7d7130c6fbcbfc15207557315a92536761f70cd4ac0bac02497ec283e8fcf03532d82ed76d4e84164506b7d0ed8a8de7884e8fdd1fa58940e4a4827632b4017030f907814cba76c31fb0d2abef318ac1ee19b424fbc66a9f995ec04a4f27e80f154b3a33f4c4e1c5fa376db4321b9fe2a19433822c32b0dd1cf04b48b6d01ccfd3ec4d94ed5356eaf1d66b738def8162beb5a54ffb7abbd1189891f67d9f1e87a44a7b65711f59b7bb39813056b50ba671169007eb7f4251600e305c6b4b9084d7921f8b796da991c001e5f3ca0516b01865450d785ac7474e1c1c40000000641118782b705599f838a391f54cd9070aaa0a6f78d945535921841e446f9923b18abb28fde4db808e11889f5877484f15ff1d802334371041fe6e64350df776	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b63000000000200000000001066000000010000200000009a97e957330623c1ce743a960693c6ab10a5bcd42361f94a6aeb5f75cd426c3e000000000e8000000002000020000000488e2ec99f1c83a7f8972c0eac777514b402f98b125914d33a598d989eefd5f6100100002c86a8f26830f02cc4e78f9644c85b5dff7e24c9c075ef161c1346fafdb453523a79d4e6614f03c243120344766640d17c891ba266068f8f52a7c5e827a0903ba1dd9c59e8705c7772e87d812b7141a1bfee399209df85628193ba5f137688fefe1e2bee8fdf108f58de779e8f4d8260d59b9d06c92dc76666b82ecf819a6b5a2cfa972c46d72eebd1498a31df8124927fe2205b1df24aa13a55a15a1985d11a2195dcdf2f89bed2e1a522d1f0ef6bf24b5a70e3f600d8df970dc02c4a0e617745989dede24ffcf1caaabbed4588a9658ea91dcebd2674e2ae7714fa534ef1f022f502f0e7048b6f6bb1bdddcfe66d56bbbe247f44792f99c18ae9d57569d91c63f41089ac1b3a4c239b41abb3a5187640000000da6d8b5b91f39e3cac5f58c471dcd23e40bcc38a265a50762b8725dd88b027dc2ce86be9f8852c4c2253db543059cc06aa170e1812950e53338078cef4a246e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b630000000002000000000010660000000100002000000010dba0a55d0d2e815765e29ad236400d6e0109bb6f5c586fc9558528d6056544000000000e8000000002000020000000574c15d1aec873fe41d6d9f1f816c654c113c0633a081ed2e2a14e9c129a5077100100006a2bdf3858e8dedf1edc07d2a09e7a3910e34332de3d6c75804bb10ce8ad6995ff91386840c64314f10da12b35e5022a7c85a78384cbf8e6ecc3c0dfb26ea3b89636215f81f34e0b9738d5d87bf4ea17094c1dc8340301307498e26e9cbfb7a79f7eb54517934b747585a028dd6b89b74bb0a79beadc42b9ec3cde4a13450e8e7452447566f5d8645f87f237b370c1b1cdd8b276432553f58f3ea36d41032df0cde022e48049485521ebaa5a38c5efa74258ffa7e88ce11d92cf1afb8863913a1c53ff66a86e6934df2aaa68cea82027a261c296db8e972d6326c90795bb9723242613e407c9451ddeb7a8d8d9a5b9a6ee302babf6c1f13aac46335e5992b439210ade1bbf74881a18fc11a306e8d6ff4000000009d921d935d89595454cdf6cd3fc1511f8e993af1117dc950fe431dd8c6b79d8b9487862e87652810681b61dff1570e1e1609e77fb3f8c1681c19bbc87719123	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b630000000002000000000010660000000100002000000060af04b60830aabbf76af264b20e636b70910c71394ba167338fa9ec4ea817ad000000000e800000000200002000000007e7c059942ea0fb0f6c31038ebf755d0ac495033ed67cc20f303dc8b93b44a810010000bbd39f14beb971a074ffd03fdab47fe59e6a26556c5a9b4c72bf9385a5d7bee575caf6d3234e3f9f945f70bff479e74e3513fc804609feac58cfb347f94d494aff14c0c2dce569d2ffe857cfa3cf4a3d915efeb9fe6318e112bb37a080a982b82363fc8bf0547bccc4862bc39fa53202c06e07ba726b025f2cb54c3491d6a53e9e68d90a34833b4d4fbb8f7f4f9c224a5513689a7b2aacacfac9010e829589d118800acaeeac48284ac41c21b243a44f50aac195ccffcaefe409d31a469d7bc0568b8a75fae72abc3572ff622299e68a3d551858168d8cc0f4ac0a733846016897d868126b1c5c62009e8f17c2b9abe84b5456162bc3a9053c0c39f4928c807368909d5d226073c318e83df046c6153640000000bc49cb62f136193ed851a2d0e7b99dde2fe2c0def84803f3b06b154473f6456391248bea4c3855e109cdd2759c6b97bc75cb3d29c59d82f33838b3b41c8d3220	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b6300000000020000000000106600000001000020000000b7d1119d0be9b7660e0b2d09ccc73a97ce5c0f8a94fd579ab6df6803d93a4cc9000000000e800000000200002000000050731fd27ac10fd80a645bb42d6cec8fd2b5564998b688dd4e1c544aa0dd108b10010000a7414a4f268b6d650f39008e610a3e6d6658592595e540e06faedb5eb94b15db024af14b71e86f7a1612c2ae4b95d78a3958ebcffa9251795a1689cbf4c7c5685b0e5a11e31d69a67336aff4290e72dc0c2852c52142fadf7d7577b2fe2306b99c5db19a869dcfc83d31ea3aa7e8f2d44b15889aba88301d7485d945b3ed431fab08e03b8c0aee6d3ce0e3621c230487111898ca657308c929a2a81643f70a8d7f2a763d9d17c2859a9a19c463d721cd4fc2249bc753da4799f97574c40b8a0dc16a5db3666e6f76caae1e3f742730e6f1a3e26ee40cdfb5384806cd6aa0668214042da53c7f241458140b93b295aee2b6759868ea540adb8659507e111b0340e6a5399fa78c8f9a310efeef8ad8810f40000000444436eb8678865c3d0fe152e4c100f841be6dc3092c2b62a2db9e5f049692df6410a93bc2d45e0f6292d11d31499b26680ee6472c54034dbf5ba2a8101b27b4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b630000000002000000000010660000000100002000000026b993a9b9b2dff1afbe955a18aec301699fbe9867076a0be588dc08590ebe26000000000e8000000002000020000000026e1c9ddb5bceb0ee7bbf9b1bd608361a616a208fe99bd8e80a09678e76549610010000a7965f799891bff1286469047cc54afa25a543f59578953582d1374ac339c7fa781e2a610c6ac90a64896eacecddd2b7044137ed7d6f43ffae6880e3cc40604e9a5b923e720a92efc225339c41f26170e0bb13474ce1373c338d4a99af75b44e0909f202eed0b5e0ecc056bda572ccfed0f87327138af03197a2f5de584c400444bae11be321928f59e36a809838ec0ebdec28fbc3b8ed56d0c7059c3d6ed4377179795c4170df07c29c47ef3003a49f62bce22b938b894081cf251a743cd45bbea30df4f7f4c3896c933e0b5092b30d85c9589f7b76bbf35546fda399b82e2ecf8caf77858b135d2a03d9fafa4c45a4bcb73b7c79894c027a35282064dac8d425263fec615044906dec507df7ec5b70400000002ddd288a3ee54dded34a7b9e4ca915225718229f3c9659c46430529cdec78fe8c957bc1b400fe5623f45be711e91b5b1bc3a1339313ab29ee90f902812559024	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff94020000d00000001a07000035030000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b6300000000020000000000106600000001000020000000be48d2f41ac9c876374407c52b708f1b7a342c27f591a5493d5d74328796858f000000000e800000000200002000000019912a174a53c9c2b590dfa4b6792be9cd895cb2074fb263fa77f8bde7a328bb100100004fff7c11a9f752645bf3e11e8c0284908f30d58bd25780fb0383da87b711e7991326ec72af5eb699546f45af1f1f56850b181cf9c38f91f258c62a2528e93b7bdbbe73e0b534c2d219f8cc8f848266b8cfd36bf764098aa5efbaff30bd8934dd8374db04698e93fdf11ecb97563854bfde2fd86988c5c9d422636ee64729b69031048a0b37fc506e52fe0878cffe6ccddeebb3ffb074819e9c5fcfbfd674fb07cd7688d7f4b4819b85f0d3a731cf4abb7e879b847d2005ec6e26c26b8e40725fcad95e3d596c5ef2783308a621573cf33c8f55efb8991f26080eb5652be99f81a5c84d7e0b8bf256166cb9db91511c727a19f6694ae4d1597761ff09806d4abd74cd21005d38ce500d8b6153b2d01ab2400000004cbb7d2e6aaef58f0f671bc7b1de84536fb24864fcf709745549016161d77b8fd7352311d70e14d5543fab061273c2fc4d9f4ad7f3b8e0c17f6bf42f6275a3f3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000fffffffffffffffffffffffffffffffff4000000f40000007a05000059030000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b6300000000020000000000106600000001000020000000eb5f09843f4e24c7fd10ebdb5e4c7b412a3751c729832e02af4dbb704ae5bffe000000000e8000000002000020000000cbe00d637217cbb8362e22ddd0022e138ed3d997b8e37c06121a80b59dc9fa88100100000678e4338bef18f1fc41b7c6c02d1205eafb7072e484aadab8eb9caccae778b2ad8cb1b3e60d22c144717632ad39dfc74f3e946022e121bf36c02c31a176fe35d8fddfd7452c587647daffb39af9d737dad3d025c4e539e9abf9b6654dc6dd00ffd4d52b23101bb2c6f7bb0c577aa341b6190c71b0adb6acc33baf449cb0d4fc04e45f245eb5b5a0b7753334cc681d05bd3adec203f1bc787474499cbe1468b6f056ccc226d03b0dc69e90c29505fa15f927dcbcaa4f91b4d99344e93ecdcdf0e172c3a7850a3eadcd73e60b58cf20a27fc395603074c40b517e3e1fdffa896d6898c32729ddf783d6fd7f1d898bcdb53eb4870d82bc541239cb1106dc28275db54697cfe5ec49670ae4eba668200e65400000004d42b9d2a03f9f4cbcfd21d50422e1cf876289e213b6a45b287e8b0e9a919b67de6e2102bf1e477a9eb8661a6e6280b244e524d6822d5fa3ebdedaaefb5a382f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b63000000000200000000001066000000010000200000008bae926af61d5bfe6602b1d2e55e099358a1ed1aa6ec3f754129e9872005f1c0000000000e8000000002000020000000b5f6cc02009d32c3a3730e2d5dd080b6d3007657f01c3da1b09e62c0896c76781001000004b96b3aa1ea2ea22be1e0d20573ef5b85f3e35d278955f10b300a54a9721ab86ae81de33d6be07d538718e6922786d2ba5cff1314c6a2cd3f94e5a09624b440dd6d8f6bf8c266ea069dd9cb0d15691eeb16b01d260c1e7e5ec90f914af4f2a5671c3748fb7a206bcdd27a1f0d4648b4f6085323235326e57bd9391b6124f2e848f572396d3d6380a90126c2c837b767ce0281da6f9f6c21da1409cedd51fcd7b8f2aad85ce5406ff23275986af9b6ff6bd8b6816918155064bd00053e4f21ef3b9d55c41a96fe39af1e14758d07025a2b1965e5dde1fa6133a5405264bfa92524224b45202949e6b7e39ddb636a87138307c11d01d8a9b5f357f162ee3bfae1f9d353542be704c258cfffc1fa5d07914000000025edaf358dec16d3132f34729ff20f2d4b79dfea98ddc2a02b92e12e5d5f56ddde527ad6cca257a4f7590195b5f898e849f33b52370ee4e648eec8687f592300	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b6300000000020000000000106600000001000020000000f70aa9bcd3f6afa918d8a8c0e07bc11252c63e6de56afc2915f3417f151b86c4000000000e8000000002000020000000658789ed7c11218a3b18701c261af0205a694c859a88e9f50a677c907837dfd810010000c75fbdf0a671b06e4c911587ddc344fe605345bd47073f8ecf7be388ac6a78eafe9e1ecf94e03dff8f32c21721718e83aa569d7917ec272bb9234fe56b526b34846548387f0f0c8cdee92e92cd8eff29c62e3ced4c8d0fe8743b5f953d7d17f8073014bf657d2ace676be1f7d49d33177716c078fc6cd8a4d59016089748ebef64ce54eb54ca29c44cc93a7b4d724e24698a9b2cf5d1220b5f8057cdffab4ca4394a9b925dd3b982718edf3cef18eb84036f4cd605551478b48a239d78e7bffb85ea6c2e6711642bacc664c612c56324a9079a3fe7fbe17c10ea6a3ae6f64668532c3c673e28858e031c583931dbbf79eccd58f0d712e216f9a0994d940e009e53e603ea3c5f264db20ac62bc5da715b40000000a9f369bf0282abb5a251487b03324648070d733db9b1245d10ab9ea21bf9cc75853922c319327c6d3823d507114ed3684935754971b9e84cf1210e5d2e4b57b1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b63000000000200000000001066000000010000200000001773a54521059dfde7db8b74aab5ee6d24a84e8acad9cabd6a642e02488d75bb000000000e800000000200002000000073ea2d44cc7bbf47ddfbe594bbd212b74ccd2327b84fee815b1c37505fde637610010000f2ef35c7816350409d0b406aebc09cba4d7649437c20dd9a3e109eacd02f8a4904fa923f25d025e9e5e5653cbc446607c2a8e34045010ba3dfb33e59aaecad1b8ad9fc0f256ecce1ae2ea8a1bea5b14f16fa585bdd215bdddad8b8de248bfc13ba1dde219ec692fe5c02999a28dfa6cea528c512a56c4662994407ef71aa9f9f20934435a217ec1017a513bffed6e457a90798898df68ae10c76b26889b03d9ddcc5bb7e05d69c1b3b78ed75863dc7465151865e94b72118d203623e8b804eb8f4cd5a4f69e82872408ad20fcfdbca8c6a42edaaa09c4b18652ca235d4508513fe948f01144683aaa3ce5250de578742d0bdb85a3adac60744ffe0adafa01a242bd34fb9815b9fcd7f0eeda39e78c8a240000000859ed7f7cbc3fa95d197a01e5b5a4c76d7c3ca90556245086c1ad40af56355ff302538d8830d1cd0f229aa67ee60ca93157e55d1c818e6887796be0d3608fd89	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b6300000000020000000000106600000001000020000000c81f8e19285e0f9da8efe4cb4eb9d3e3049696abe2837865edeabfefc32d099c000000000e80000000020000200000002669c80cd91e188af9e8a1744fd76617ace7c9a889c46d6ebdea3f030758001a100100002b8aa2bf137eddafb343b76267fbbf340f7fb2881d298c96fe74a86653a6fe737ce2488400f8e5bbe4c12d29f6965f7f819e64432e6a183ab35182b0722f23ff1d2e9843094c01f6c92bad454c6f0279d750fe46fbd81a01f977041b829a2a276cd7ced84c3b95ab292bf7cf0d39ee6a171eecbfdabe3fbb312113f04f7623d8ce179c5333982295c29902cb4c3138957e993a0368d2162ab3d82042bdd0d732b0671100f42fb70482c30688e8c43a4de9eb52ba8e1ba4f5e1db51a1b4a6426bb2d95c8be02447bcb0bfa6cb5c662438deb30e66930d1e8f99f57043652acc90cf8ed5d0e6242650d7b032fe7fe09547566376457033c43868cc36588829669f1c70098e2633ae951e19b7e041c727c040000000c03e24bf7a41f365d8534b2682b6dba4470ff4ba66116438cdff4e305ce61438acb2f20fed9112e158e654b92caa7a0a92e1d533876c063bc86490f47ef08726	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b6300000000020000000000106600000001000020000000984921a5d5a41e42432107504e100ffcfdb94381a5d41ad0e681ff548be16414000000000e8000000002000020000000f2ea00d7fe3677986b73758280c8b74aa79386ef558f7554a17cb46bd92b07f3100100001d79757eeb35161328e604d9396d4c15069172031928414971ea32acc553a8a46df37769a24c55777f9e6a6722c8ba654acee2135eb33218ca651cc14b5eb7e98f271b8c3af0be52e6eedc8ba6208ca3af400dc68485cc4e31081d63fc841326c3fa9ce5aebd4463f7e0e6e4d28ff15766289f58518636704bd8c2606360e49a44b102f65d0690cca6d57dce966b7d19033f0681a3282ba2475a55d43462c46e5c84a850e3c9ea22bef4f4d82661af9ff28b446f9774fe19e171c703c819a63ad3e6aa7e5b157e84ca36798877d3a925493ff665a726a1d8b17ede0140ce15982597ed25c5eaa38af7648c7e0922874863c7691d7511a4c5246d5b7d342fdc01ffbc7a3aaf4fe2f280b1a97e84669eba400000003ebadb07d554c0bc03dc9a32e7f48b84c1a83c6901238bf4f49effc98e6e07489d1a125ddfc32583d12967e966e8a338d97abecaffa17c051c9d95d7bec91b23	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffc4010000000000004a06000065020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b630000000002000000000010660000000100002000000061cdc11d53ee96fdcda4a418af9a26603dae485002e6398bb725fad50fae8c88000000000e800000000200002000000053a390bcd6ac0231829ecea70d22dea86ba820ecf488e80009155b60fe0b841110010000de333be9fbc85dc09e094231a5ad7f8860cddf6cd90e5d86d497eb39b9efd0e08e4707031f1a4265bcbd09abddf616533d938c66cffd1ef523cf2fcb3a8f25819a28cae0f44df399f8373a3a7b0e5219070101053d46c7a20500d4753ebb234a13f0dbf7841617615ae7cacd99d17ff00afbb4519759954aa3b9203e5cc2b9f8e00de7d1671fb6d875101125ca73392752dc6858ca62d6b7cb6768e99050baca85afede5ef07976539a419f8a9ab8ae1b0784c7c7c47eb5592a93ed6b9eee7d76ab08764e5a2465f5be47ac316fb6b58a486d6c0ff46e3e1c9787d7e03cd483d5d31cf560c01c4587a0e5230aad6d2d58a6be19f3793346bcf5d989c6e65fedf0ca32f804f51d1568d0e86895edae9ff40000000a7d5a63e7036b99c78a1e882bcc7012573ae96553dd8985b9e790b9e13164c8993e34aa31655c81d5f9e59feb107cb020a6ebdf7410dccbab97156697d252f32	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b63000000000200000000001066000000010000200000004f9bf0effb1f5e11896aace98f94123312e9d0b2622345ba0cf9165b29cc5706000000000e8000000002000020000000e7fd02b3cad08737966e0f43fb47b4e7ef6b11690a19a0336ca1a94033e23bc110010000920b7112a9440954ee1ca5107ceec81dc3a98a7fc9a27d59217ea2a9d1c34540f2efb0f175b15a3e35d9ed2850fb29d31f109f39785d186b69b88d03735899ddd6ff6add60e01ad5424cbdd5e18ed83260f9ef85f908b584e5455b0e1503fad78672307e4c69b3b3598732297e8730519adbb9089623c88b7f72d73d0c39a8dc3531565cdbc11bb11739910fb822c9316da6d9109ac6319711aaa68c1818f4be35087a9c3adc77ba02ec814960586372d2076723cfa4c5fc0be0a17b1dbc13e3371a1734f589d390a712caba0d7dc45180c6a2fbf5a8a34bc0b41915b2d8126ec5f2ad01e1ee9a6c1513e1a93bfcf8574020b86484ffc4d95c20a1ca4f271096f685ce3efdac755d9d1fa3398dfceb7d4000000026eba44451766f641f97e642be4e544f10bfbd04c7f9b0e8d8410cb0252ed530148dc66586fc7833b1accdd37e76b74c69dc70e4e5f7576591ffd88d222b812a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b630000000002000000000010660000000100002000000093a18d51d51bf4c9902e2f277259233302ad11139b3fa183777e30aee2b3bd19000000000e80000000020000200000001d5ff17dc328b2bd4424dfeda84d5c83cf66b6d078d25bece3f84a09ca936bf110010000d9523fcd7bfe19876f6d4d05f948345c23ff1ecd8fd245f9fd8d1c4c8861952ec2e1fb298cbce84ed7f3badabbf3a5362d1bb25d3bb5b29b90a5a37a89319c389fcf7fab524836ab50f7e4a4d2974803276981fcc21dcedc0b7cdc4dcd2748afb40722d9f914e5bb838f964a50e04cc0665243573768acd0a0ee8b0f3c1a5df6f9f5e90bd004429e0619c7dc872269e9c8d77ed0b9f8f7b1c686574c3d57984864e8a50d75af5c4f77b53ddb281c4421049bb88b17e5ddc37fb2c257b737287a9bfdd7ee16e00a8a0b3601cc29c37a982884bfa69e206c669dbb36ba6f1dddd6e06cb45e75878cd0abfd41cb7392d9c901ef5b7d18ae2b9a50694167faf7046375310944f2515f5da6ba2b4b3c3f8e6240000000e1ad0d2109603ba8430b756bd2c38a156647eee6ad14089dbc4021e2a534d5cf2b6050349a99b326ae2e00de749c7f902a48589ee5286f73504a84ee0216d55e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b630000000002000000000010660000000100002000000060d6362809f00fa14def2fadfc8f598ac093fccc4ff9704f10aee0255fbcaece000000000e80000000020000200000008b9bbe75a46b8c52ac8b0ff12a7b78191fb096aa2e26c3d4ca44f747a7a810161001000067a8faee40709a1848b0739bf8b7fdea065bfe804c80eed71ecb0441c70ee704056bee894caabcda34eb98761641156199095db6840934c73f78fd003fc583fbc476815270c6fa1691bc57cad60a2cee3701e338f55630be93e304d2a7e6f06acc34f648c25b3558f021c0ec6735e8b0426b9e9258aee38dbb4e4b07ea6b87b39c5f080426cc41b01c4f86a71d02e481b81741bd35fe33856e771d8cbbc3544ca4309318a73c800f4a9e1a924508b10d5279f7b163f23b66599a9772aa082715d4de7145f3fda4d403fe06936aa9f916083325c4fe34d69a039f75fe97fba2637166fdeef89f92215afdb016bf5369d406b141628b43df4a725edf149a37c075d38fe9b62413056f32c22b1f707d06c040000000ee5bbca86f90a0f54a4742825ec9590cf6e5a3d406073ed51693fab58fe74c4d57488ff734f7fb838d953b2669794a5d32cc25bb24c005de669899914444a953	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffda000000da000000600500003f030000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b63000000000200000000001066000000010000200000004eef6bcb874e610481f079ff8d4ac7940387f00776ab51d2f32db4ea94e5758d000000000e80000000020000200000002af82015741acfc1b3ed53b6a3e154b23efed7f9e5ed5d012415bf39089420821001000059cb72d8ef54f4d518c367c013ab1b1895f17fcb93e1e53c27213e698275fe3f779e0dfffa1a229e75c9aacded9cbd86e10cbb8d09b225482bdb8ece449c339b011808e64fc2372e986a1bbc3df04a4dbe7444c875a7990cd58f633934745948b82d8a37f0bd6028ed516740f58ae9c5cc9a5d45e31986952ee1ddb300ba708afcab68486dc22b7f5cc652a16246c13d1c845d184007ff62e8dbf47cff7bd4ace52909771a8f7bc1870071d1728d57885da4c3c805a0f6437f1495cef9470a11d42ba0523d57d89de932fe2099b0cc09480200810f3865e10bf3c9e7e0856f6f43312181927bad70066bc2f3cd1f417aa6402fd022040e0469171e10adf84717523ad320dd410a9c64a0e310518b53c540000000b169a9f46360d48afa557925a7787f0af3e8a7ad6d73bee41a6db8ed9964e5aaea2799439416335e2019573667a07cf7b26447d91d08916f4f34ca1c3a4a2198	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "223450520"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{30FF3853-3B5C-11F1-80F6-FAA4D0580D5E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b6300000000020000000000106600000001000020000000e0f20e45595ea8d4fe5688978484d9f7034c6511a0b0292390f4170e153135ea000000000e8000000002000020000000cb446fa60016f7a315ddfe3c1f0dd087a130615f17764a7aa325470a5ba2334c10010000c9f5b9927aedca689f5289557b2d013ff7cf50f7b914e5eff5729d18bb1a23ddc681be31b4a0e638da9e33218a4dd9d503876d4f649774d008f8a28d34fa2ed3848177a3bdb0e463760ecd470ce66dcab66f00af45af296c91399d951ff1a1081bdc2335c2152c72542fda553c949a5d1c3a9127c4a1634edbaacd9b211acf11b7954f6db970ca234d8e69d880555c3ec60bb8dd32c5cfe849960cd1f2aefc628e0a970cbb25acc892129cfaa2f10a9f4d5bb2c8b1fa8406c078c76b97417c0e3582f316fc59d1af1cb8496b397a68e0dd2225e54e637d6a2f5780458380721efe32d8c4c06fce7dc88a85d1e2ff38aaf48d1ea2894901d9a5a84e7dd7eed8e865d50b1dcd4c5f4ab3c85dbf0c590000400000000de6e492d56f9ed7b25c05943518d34dbd2066f6f5fd53c61aa1741953e2a174357eb4be8e981e24f54b79eb20003447351637e959a1aacfafe63496424afeba	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffa6000000a60000002c0500000b030000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b63000000000200000000001066000000010000200000008ac6215b8d599330ae6229dfe0ad75c98fbb1c36c5917df2d4354e2b85615370000000000e800000000200002000000004212ea19cbe8291b82464df58bbaff06522fe3a68817f2e5bcb7c5ee5e2648810010000c3b7f9c82e143aae082618743e88e37750d25db63cbc0c63b05870d0ed6073e443d00eb6f3c806f6223ec74302fe2672ec049987ee19a6d670942aad9c1cde755553b4a105cdb1318462290f58d7cc30976011b895f3915e6046e490addec652a3c7cbcc3aacd7bdecb324906f07a2dfe1031786b1d0e3562a2966d5b26627f6b16573aa48d9c9bc9d0770f7ebd6d3e93d6dc35985cb2c22b7e217a25d072b2acaec7c17b7c90855f18d065f02e4e3bb7fc7ca8b02b03ee83e3257b8fd5b432c2542fbcb28fc3dcfc4b1d528d0e52c2acc1f25f483d0203b45a9e6cdeec7e65d5dca98a46c505ce333fba03fda813b199195a8d25bb4ccb4625d4ee51eb64277b75ce3bd997d252bf48fe11352a1e6b040000000440bf5fd4f4d51f12cd1d19b1bc9bf88ed3d53564816f9311b380d19d1b3c0e981b397a2b2322fa898dec6533792ed8ce86d2370b886aaa0c1ce0910b6d3ea86	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31248233"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b6300000000020000000000106600000001000020000000c43c33ca11e58fd3ce8417f7989ca2ee2e5ddf456196e9368e3823f8533774cf000000000e8000000002000020000000f595ed9f44c8982f2740d2a302771a1e4877430f62dab478e52ce5db0b0bccbd1001000039fc808accf769c329a4a686e63e92ae69866030e38c7121ae0da5ae080359c61c7aab527c16d94179a17a2a196a7e5cc84f8a2e72f0ed9034ddde0599daaabf6f5656a626b0acffb0e1c3cc6655f115319edd15b90ba978f2261333b243ef23c6990fdeab69cb18b36a8c4bf0a6b9c2beabea565d29b83180765b67568e81790c28250e9bbfbf5069442292e067b43686a2ef37b5edbf68f3358eb6f0b618897bda688b0920d14bfb3779ac91505d62541d3a7fddd4f6539f5973da20bddfe538bc1e6cdc6fe3ba0505aaedae394134dd77db5e805e783dd47da82c701602a4f6b50a041f8640f2abc2c70af027d4094b7acacd98dc25421c68baf95f424765c13ace1eed3a76285042d3785c1b883d400000007991fa15578fdeac7553dfe38c97d0ca906f9e32aad7cd114a2f4f8010641cda47b77e72fdfbef7610514f35377db3792b7d6c0659ed366ef9cfcff855831998	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b63000000000200000000001066000000010000200000006f6a39cd7bf2dbf178b2d65dd4a9aa7d66f4bbc096ba422fbbda1cce3d10667c000000000e8000000002000020000000d252ece883012a18430ad1563a05774bd1b86294ee5e76a70cd2dadd6946460710010000d2985511f0c353dfbdeae13f2844d36d2b40ebef8262fd00ea0009543732abcb34a933a7a29b28199fb6b744fd910478cfff5ef949c37ceef9b466fcd3332fb2ee122638868416e6c9083205794c8146dbb996495c697d974dbd9d41c6945d41debe37ba9a68162d8faa621697a43afb06dc2496d9f37d4ddaad45197fc477f0cb379ab8d2393a143b882a4835807f9105bbd5a797a118aba5a3fc7afe587647bb16f640c2f42afc5d09c53b2725bb8c948b0c391e15e4de73b4de1e5a5c9eb74e3e34532bf228afaf9ed3ceb99042f56a55c046fbc007b7d01c6dacaabc4762fa95e7edb8a52e13ec4fc06a8c5efa7877ef8c5beeacdc0a7e423ca52762eaceb1fcb94f75a0ba96ba8173e6d658fa5340000000e098be9d0a641d230464c748ee3cd111445ec2aa77356fa5b1556a241556ba759b646c118a624afe70234c7d112e8d08768b5f18a5efb563e98befff0a4f21d5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b63000000000200000000001066000000010000200000004055b6c3a5163125047f56095d95056bf6114ceffcfe085bd500e36a28e3ddb9000000000e800000000200002000000010e3a2208d41a66f0fb14e908c8d28abf40f75f93effb959247212ddee972eba1001000074fc1c95f8fc8383a0b46e206ec8881b824e03dfec9d29f310a3ac30182cd43d2bdcd06c7c644355c7f668b01ec61beda2b503dce4c758bdb79d6ce6642f5ba7e959737902051d0daba73b84d223ae9c1f6a957b67fe1ce8d3f859a175fd18e9bec9f4d01361e0166011184f64934628f8c4f2cd4870911f9e08b7471dba52fc74256248b4e7d477e8fd38246631f29fb9c295790a8e3bbc02e00648af877cadced07d15f4bc238f86f77aaec64ca860d4d400dbb106e015d12c91806e99048da2d4dc39c0c2ba36928447b3059775e88c2140d94cc54bea2bb3ae0c62e69469980dd75cdfa49f0c6c28270a7e9a8088e59da6b3d3b97b8f0d9e5fe297933bdc76413867f5423926d66522fb09b258d04000000083f48fbd827472a2ecc86a7ceb8d5f27f2947a04fa2e8cd657e13359fd44f9f3f013b1d2fca24d1860a196dc007ba2f418ed3cf2e487f686bdd3c2d7bf071828	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b6300000000020000000000106600000001000020000000488126018fb773eb0f93817ee047e6513a0765875293c9b010ff2949ec8e4ce2000000000e8000000002000020000000ae77337b8e598fbf980fab3433497d73fc6154a229aa847953fed53fed764fef100100006e417cd3bb6f905c71509a308fce720595b60475ee6efb8316f104fa4ac3fcf3b85ce28292f9506234e03e8e6b4b41c996c97314274334363a4c9b46f41908d1a3da5c05658f2f50da426a434dc5bae8f41e5224839a23347c40749674e0d21b5e7b992234803628e1c164b4b167e3e1b7272d467ca8798b1ef4cdf940899b45a32567d9e6fb73b569dc2a89cec9184b90dcf143ba6550e2ba82684ad84e7d787aeacdbf85314d70d1523b6fef076b86b49a76a9458f0a233c1efa9abbf2081db1519fb5d509f2e84881b2d5921bc4051ab9c98503d025d861fcc01ee76064e44b8b779cf413b7f8d94f542ec318197155f0c1d77e38bcfc0ea7135a7d8c10fce97670468b761055a97d507894a7c1e14000000055bf180d9c108b71e498ff6657337b9d8756e00b52eb58e3c6a3080bc3d2043ea579bead36cae0f07dcc543247de48db3c83fa10ef9cd09ed83eeb95cb1f592d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31248233"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b6300000000020000000000106600000001000020000000edd239462be3a90b1e276eb9c250889ce7cfafbeb212a33a72b8cd8f9d7d5fde000000000e8000000002000020000000125da6facbbc24a215b252035a550ce691f3baead24af836df5507d421e030c010010000e6068b3ca5b832066e72ab92ada1a11fdb182d5fd5b472f73bf1c9c6ac79efc8ea906579138b36b368503750df6838c3e889f3866ca18cdcbc5d7348f95ed962cc9266636942789a5a09cbc4c442ed4f200391e721019a08206a333e0995bcf25e1c9cd0548ad4867a68679e5f697864f354a990218b2b8fee0f94e44c2c549801d9410e0adb9457d37ec72b898f376ae6968ff8664b8cb6adba3073c55abaf94e70652cbced8a8000d1fd1110593f1f7cd4c1b5b670e34d52e3f3ac90e9ecbf7d0098abe54237a371c8b6057f333c009924b1b6c25afaf3db372970dc6fc059a05eddce6c0d9d4adae97ba7ef277c0bb12bb108e8e6654d30bcc9d88c72b7b23ab3207df93f8cb1ea83316a1b15e9d0400000003f706c25eda22532279ce0c6dbbe2c993d3c742455a6e4f4cc58fb239c16dd82fd99c41640e758c914a0d04d5002c9e1309db7e9f045ea8ea4fb54522317c88c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b6300000000020000000000106600000001000020000000e37815828cc5327a3e7ed6aaf8990bc8a523d4da2836e0e4ab33313acce75057000000000e800000000200002000000061472b60511e400670de7103ab7da8e00370f6b0ebcf1256ee43f2149a966ab1100100007ef99ddec7ed41d46a60616cca099078b6edfa3b492fe16cd06c047e193f13ee14bad71751f87ef7169bfea70d8f6ac980e7c43142365197f340568caa01be5b7fdd99120e9d3f75dc89be0a97daac7f9b94843fbbceb5b797498538b44a7d3dfcef678d70123fde4067ae405324d66a912bf01ede7084bdac3e5b55cf0ca11816ebd371d47ecef8c93112687ce01ef509b7ddcb03e8cc954abe818d79863a181d69cebfd879613a7b306545dd5457690b8abe82beddb761dc520fa5d91e89cffa1b5e3df212e0cba3c7ebb9d82050d08796a33edc2aa0638d725f31ba2693b9c53bbf4c312d70d3d196fa958dd72f581e01f9932165baa283c213f189af9c88e34b9151e5c578d3210eb26e5599504d4000000092de28377384201e9c9497920c119c9bbe71e59f5783843bb72cda37bad9e10e818f68363596342085a716ebf229a3490e10afcd3a23a9d84f9a062fa2d4c65e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b6300000000020000000000106600000001000020000000cb0a37e7823ee065f6df990623d6ffed77a67d18ee089f98b0ad604b4eab619b000000000e8000000002000020000000587e1ac37e9f77312ab39a4d158c19ee70e1a1415ac9683f9a7d5525ff2d447b10010000b80c4d7638fa42e3c559885377e0bd8434d49616dd15e300415bee116c330d9385e53df6a2f15d5da5792ed09a64fcb57dad90382c494f9c9cd59017b1cd71b3c9aabf9e42e0a5ef5e393e2ed45e794586632483e6294c3b1e09a7860140721835235046512e9e9aea38f5f5498b5e12e272a23b78012d748af0cfdeb213a2d639a531bec45046e94d6fb77dd737e4707ccec771f5bceef3e87a045c5ef28db205d002865962b0d16d613e7ccf44c0a10a330e28465bde0628a0d40679233c6ad76c6dd6fa4b38ad2c2fafdfb068465a728c5ed8e4d90f561ddcd6abe152372ded3d99f329be195908e7ca3f331fe5ff4ab8954d22fdd4cce4849d098501e85260dc65ffbbf3d6bc9040bc422992d07c40000000b3127ee0e4ec1ae9e38b9f57ff0b159eead684c0c597a4243245292ad2e9d36b6f289d084b2baf95d7bd8a3676624a235da8a421f8b4a7d9a78aa2e953efe3db	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff7200000072000000f8040000d7020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b6300000000020000000000106600000001000020000000c18813a770723fd9a0682acc33ce48d6b46dfb62a047467917871e0f2d9ca0a6000000000e8000000002000020000000556c34a70463b1110f3030be22f0da17639a336df3883efe20bacb6d236003df100100009a98645a211cd6d3ce8274535dd487e43663f844ad16995b751a6599ead734e1751dbd6492274cbd208003172cdf35bf9f7a5684393b00d735121efda77b1a8afc95a0ea09ddc41a67a870d2d523f8ba84df7433c37a85af8987789b4beaf46cd22b9aa97fbc2207d12c0c26327bb610b31865f12da6307e6471a3e3c7531b1532b552fac1ad0e4b98526be5569c8b99d310cb39df9422bcad23a48f4bf02d66cce3441406aa794a524e7120a538e6f30b7f2a872a0ad8dbdaefdf9c80f533a1f656b2088967daebb905801393a7a760b694a7807279647e6ab1967946cb2e3c78f1717cf7e1b247346ab93dae3b53afc3adfd1f4a9341644bbeb3740c81b85024ff20fd7b50a3d7ba6a2f50c51469f9400000001adb01ba2e282a9846afde01bc6dd9d364eb8d65b3f9aa1dcb793a3ad544f176a79b9728cc972365b3b38b67286f083e424d7394bdc8699bc2eb66693c520041	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b63000000000200000000001066000000010000200000004e1e3ec04ce79084f075d7060a11644b24574272afb09813a24bd1f7a118978d000000000e800000000200002000000002928b0ab3040513df9f48824b1c972a31ef991affac80edca7f0c77bea4a6c310010000f46cb25e57d4ecbeb574ea63d1e13cf97cf4cecd1d2efc242207cc554ee986c0b672ce6cf224809c6c3373a26c20c431b6f62dc217e432f18bceaf09e46a85f340e3ebbef2c1661996c5068ab91a705f6af8bb0fe4806acdece785ea192fb72075cc6662eb56f7045a50cf28e000b099a2573f574e642753f3471da237f46040570da7090e6173723b2db32ba1eb09d950ec9caa4be01ffc6df8fea200c6721d982cf608d947ec3e5592aa1883f50334e6b4a6394ca09ce08cd6fbdbdeafb88f94d4531305b7520769aaee74eb91e05681614ff43c3e36664d4dbe00cde04fe391e9213e277de826a1ea9f1b1bfdb9512cb9ad9d2c0ef28de132e1c253e31bfbb6c577aa2418ef5280079d75938bf6fc40000000c7267e7f862ca57460b5afd0ab2dafba5be205053acc1d568e9f5810c1bd34e5445c6fc6708c13d9a627ca4228c2450f54c398fe78f35e0fea931e0c13c8b602	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5c0100005c010000e2050000c1030000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007d6b8c196a9c9341b63381ea6c453b63000000000200000000001066000000010000200000000cee152d47324324f13033afd1cce86a1f98840a227743b96d6e5a13b770d498000000000e80000000020000200000003a1858c4935d960c7810ee3fff0c39e31cf56696270a8ce1c7b1596560fc8fe910010000159e0654fb0695e7913ec884aa2c141fe29566dd8c4dd8c8375c475731c4753fe7ec47b22248b36842f3af26ff3ec48377349db36a4424bb6837d68af8e3833692c94f87dc41c29155eeb5438fcc543291034871bc768204b4fc14a64cb1880f6e412055e739aa6b693f39fc26a2cc3b99398c346c2beacc4584588a99d34a9c7a485de58b8cb37e6fdb2e58cff0de22d0a061dc8c8ff0b0b81d5ab5f4d6fb77c27ce4b1a61718e50bd9720cd2b5cf86b552345cf5255968a420288721c662748cd82f78719a75384b195008bcea30e07d72d2daa0fdd59b049fe43f2d4a4df6fe75ffcd372bfe4494541dbbb529c5ffd012102630c1d3d1153cd45619f143365a44155718bac54972c8c2014a25c41840000000d2064d4d7628e427d8050f9bd7d3eaa20052f4f35f1cd07776b656bb583c2753a9dbcee67e00e5c949eca61d334828232300a083dff116745f3a644f664f9bde	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31248233"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31248233"	IEXPLORE.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134210137999993954"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-914486190-3969805341-592249730-1000\{8E1E6A6B-DB10-4C26-8202-2B057E8F5571}	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1752	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
7720	msedge.exe
7720	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6488	tasklist.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
3908	IEXPLORE.EXE
3908	IEXPLORE.EXE
2276	iexplore.exe
2276	iexplore.exe
3808	IEXPLORE.EXE
3808	IEXPLORE.EXE
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
4256	IEXPLORE.EXE
4256	IEXPLORE.EXE
4256	IEXPLORE.EXE
4256	IEXPLORE.EXE
2276	iexplore.exe
2276	iexplore.exe
5044	IEXPLORE.EXE
5044	IEXPLORE.EXE
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
3632	IEXPLORE.EXE
3632	IEXPLORE.EXE
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
3808	IEXPLORE.EXE
3808	IEXPLORE.EXE
5044	IEXPLORE.EXE
5044	IEXPLORE.EXE
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
1812	IEXPLORE.EXE
1812	IEXPLORE.EXE
3720	IEXPLORE.EXE
3720	IEXPLORE.EXE
4720	IEXPLORE.EXE
4720	IEXPLORE.EXE
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
3632	IEXPLORE.EXE
3632	IEXPLORE.EXE
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe
2276	iexplore.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4772	4636	msedge.exe	85
PID 4636 wrote to memory of 708	4636	msedge.exe	86
PID 4636 wrote to memory of 3564	4636	msedge.exe	87
PID 4636 wrote to memory of 5812	4636	msedge.exe	88
PID 4636 wrote to memory of 3564	4636	msedge.exe	87
PID 4636 wrote to memory of 3564	4636	msedge.exe	87
PID 4636 wrote to memory of 5812	4636	msedge.exe	88
PID 4636 wrote to memory of 5244	4636	msedge.exe	89
PID 4636 wrote to memory of 5244	4636	msedge.exe	89
PID 4636 wrote to memory of 5244	4636	msedge.exe	89
PID 4636 wrote to memory of 5928	4636	msedge.exe	90
PID 4636 wrote to memory of 5928	4636	msedge.exe	90
PID 4636 wrote to memory of 5928	4636	msedge.exe	90
PID 4636 wrote to memory of 3344	4636	msedge.exe	94
PID 4636 wrote to memory of 3344	4636	msedge.exe	94
PID 4636 wrote to memory of 3344	4636	msedge.exe	94
PID 4636 wrote to memory of 5332	4636	msedge.exe	95
PID 4636 wrote to memory of 5332	4636	msedge.exe	95
PID 4636 wrote to memory of 5332	4636	msedge.exe	95
PID 4636 wrote to memory of 6032	4636	msedge.exe	96
PID 4636 wrote to memory of 6032	4636	msedge.exe	96
PID 4636 wrote to memory of 6032	4636	msedge.exe	96
PID 4636 wrote to memory of 6092	4636	msedge.exe	97
PID 4636 wrote to memory of 6092	4636	msedge.exe	97
PID 4636 wrote to memory of 5644	4636	msedge.exe	98
PID 4636 wrote to memory of 5644	4636	msedge.exe	98
PID 4636 wrote to memory of 5932	4636	msedge.exe	100
PID 4636 wrote to memory of 4640	4636	msedge.exe	111
PID 4636 wrote to memory of 4640	4636	msedge.exe	111
PID 4636 wrote to memory of 4640	4636	msedge.exe	111
PID 4636 wrote to memory of 3348	4636	msedge.exe	118
PID 4636 wrote to memory of 3348	4636	msedge.exe	118
PID 4636 wrote to memory of 3348	4636	msedge.exe	118
PID 4636 wrote to memory of 4664	4636	msedge.exe	119
PID 4636 wrote to memory of 4664	4636	msedge.exe	119
PID 4636 wrote to memory of 4664	4636	msedge.exe	119
PID 4636 wrote to memory of 4052	4636	msedge.exe	122
PID 4636 wrote to memory of 3228	4636	msedge.exe	123
PID 4636 wrote to memory of 2772	4636	msedge.exe	124
PID 4636 wrote to memory of 1740	4636	msedge.exe	125
PID 4636 wrote to memory of 1964	4636	msedge.exe	126
PID 4636 wrote to memory of 1740	4636	msedge.exe	125
PID 4636 wrote to memory of 1964	4636	msedge.exe	126
PID 4636 wrote to memory of 1964	4636	msedge.exe	126
PID 4636 wrote to memory of 5300	4636	msedge.exe	127
PID 4636 wrote to memory of 1588	4636	msedge.exe	128
PID 4636 wrote to memory of 1588	4636	msedge.exe	128
PID 4636 wrote to memory of 368	4636	msedge.exe	129
PID 4636 wrote to memory of 368	4636	msedge.exe	129
PID 4636 wrote to memory of 368	4636	msedge.exe	129
PID 4636 wrote to memory of 1720	4636	msedge.exe	130
PID 4636 wrote to memory of 5604	4636	msedge.exe	131
PID 4636 wrote to memory of 5604	4636	msedge.exe	131
PID 4636 wrote to memory of 5600	4636	msedge.exe	132
PID 4636 wrote to memory of 5600	4636	msedge.exe	132
PID 4636 wrote to memory of 5600	4636	msedge.exe	132
PID 4636 wrote to memory of 5308	4636	msedge.exe	133
PID 4636 wrote to memory of 4836	4636	msedge.exe	134
PID 4636 wrote to memory of 4836	4636	msedge.exe	134
PID 4636 wrote to memory of 3660	4636	msedge.exe	138
PID 4636 wrote to memory of 2968	4636	msedge.exe	139
PID 4636 wrote to memory of 2968	4636	msedge.exe	139
PID 4636 wrote to memory of 2968	4636	msedge.exe	139
PID 4636 wrote to memory of 4748	4636	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://chomikuj.pl/maciusplay042/watykanczyk,9102098989.exe(executable)
1⤵
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffcbeaec188,0x7ffcbeaec194,0x7ffcbeaec1a0
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,11992846296690861467,15890207572707988715,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,13985946698755090396,3521879848924226819,262144 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,15094014364001790923,8599718976669981755,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,8425359442622986494,5302120274233965743,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,6146613434868258404,1931194435446869829,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4972,i,8365264450885664105,11681349595115161557,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3552,i,15163758584165069447,17491212602401764879,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4260,i,3573408595742785767,4200266484720362817,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,18168187149466163153,11438689008665684121,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,4010705621727685492,2894566810317435118,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,14458879973353379838,1618272819674108037,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,14458879973353379838,1618272819674108037,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5280,i,3066264020000646652,2163492572940334262,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4256,i,5540254826432806204,8435344853596026480,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6876,i,15884750239903244858,12725538803515920758,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,8051787856288179188,4454017816684951381,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,10166220706050102734,2741635154579995330,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,15381793723264838820,10496575709884001183,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,7331126298591891204,9526620488525698900,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7012,i,1424915906088060398,2914390634746994096,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,10523904767192371639,8148144053359146674,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:8
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7340,i,13418725587255304174,6738734293499133185,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5252,i,17343197421725072852,8391330137417312495,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7328,i,7925280399690822006,8311088652699378374,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7472,i,11869218029703468251,5803892367859240082,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7044,i,3243971675545269503,17002954211226968560,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,12625019257884221527,2628997045638030058,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,15186275499551644434,1307772964254533765,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,14316648392162869146,11562529868188251975,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,14316648392162869146,11562529868188251975,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7464,i,4552808030484526558,3165005052520428856,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,13745574673185279757,11062936741925115814,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:4748
- C:\Users\Admin\Downloads\FreeRobux_Gen.exe
  "C:\Users\Admin\Downloads\FreeRobux_Gen.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5888
- - C:\Windows\system32\cscript.exe
    "C:\Windows\sysnative\cscript" C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs //Nologo
    3⤵
    - Checks computer location settings
    PID:5100
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
      4⤵
      Checks computer location settings
      PID:5928
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        Checks computer location settings
        
        PID:704
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        Checks computer location settings
        
        PID:3588
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:6176
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        8⤵
        
        PID:9016
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        8⤵
        
        PID:11692
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        8⤵
        
        PID:11928
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:7224
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:8228
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:7512
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:4908
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:11996
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:12176
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:7596
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:2692
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:11416
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:11480
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:7320
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:4716
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        Checks computer location settings
        
        PID:4272
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:6352
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:9024
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:8452
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:10472
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:5560
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:9664
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        Checks computer location settings
        
        PID:1836
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:7160
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:8800
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:10668
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:10816
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:312
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:7368
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:8068
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:9076
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:4656
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:6112
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:8084
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:2760
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:7912
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:9748
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
      4⤵
      Checks computer location settings
      PID:2140
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        Checks computer location settings
        
        PID:3060
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:6772
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:5708
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:12148
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:12380
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:9804
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:9872
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:7552
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:8904
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:11868
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:12416
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:7640
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:8920
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:11512
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:11572
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:8632
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:5892
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
      4⤵
      Checks computer location settings
      PID:4280
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        Checks computer location settings
        
        PID:5428
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:6856
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:9160
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:10808
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:10844
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:7548
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:8372
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        Checks computer location settings
        
        PID:6200
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:5580
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:7476
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:4400
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        Checks computer location settings
        
        PID:7100
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:3968
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:11140
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:11216
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:7540
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:7280
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
      4⤵
      Checks computer location settings
      PID:6128
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        Checks computer location settings
        
        PID:6244
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        Checks computer location settings
        
        PID:7000
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:7264
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:9840
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:5556
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:9656
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:8284
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:8364
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:8460
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:696
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:8004
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
      4⤵
      Checks computer location settings
      PID:4976
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        Checks computer location settings
        
        PID:6216
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:4828
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:7964
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:14004
        
        C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        7⤵
        
        PID:14052
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:5292
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        6⤵
        
        PID:7860
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:8636
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:8700
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:11892
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:11988
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
      4⤵
      PID:6744
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:3664
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:11472
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:11944
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
      4⤵
      PID:6796
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:9204
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:10916
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:10996
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
      4⤵
      PID:7872
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:1416
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:11620
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:11784
  - - C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
      4⤵
      PID:7952
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:7752
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:5404
    - - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\4A1F.tmp\4A20.tmp\4A21.vbs"
        5⤵
        
        PID:6848
- C:\Users\Admin\Downloads\ST_0.1.exe
  "C:\Users\Admin\Downloads\ST_0.1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2008
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\932E.tmp\932F.tmp\933F.bat C:\Users\Admin\Downloads\ST_0.1.exe"
    3⤵
    PID:3824
  - - C:\Windows\system32\PING.EXE
      ping -n 1 google.com
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1752
  - - C:\Windows\system32\cmd.exe
      cmd /k "title IP adress &color 0d & ipconfig | findstr /i "IPv4 Address" || echo Error: Failed to retrieve IP information.
      4⤵
      PID:4820
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig
        5⤵
        Gathers network information
        
        PID:6416
    - - C:\Windows\system32\findstr.exe
        
        findstr /i "IPv4 Address || echo Error: Failed to retrieve IP information.
        5⤵
        
        PID:6448
  - - C:\Windows\system32\cmd.exe
      cmd /k "title info &color 0d& (systeminfo | findstr /C:"Adapter Description" && systeminfo | findstr /C:"Total Physical Memory" && systeminfo | findstr /C:"Host Name" /C:"OS Name" /C:"OS Version" /C:"System Manufacturer" /C:"System Model") || echo Error: Failed to retrieve computer information.
      4⤵
      PID:3044
  - - C:\Windows\system32\cmd.exe
      cmd /k "title DNS &color 0d& ipconfig /displaydns || echo Error: Failed to retrieve DNS cache information.
      4⤵
      PID:3568
    - - C:\Windows\system32\ipconfig.exe
        
        ipconfig /displaydns
        5⤵
        Gathers network information
        
        PID:6408
  - - C:\Windows\system32\cmd.exe
      cmd /k "title tasklist &color 0d& tasklist || echo Error: Failed to retrieve process information.
      4⤵
      PID:6184
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:6488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,9598513885941387289,2888134441070897896,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,6198989541977419340,7762717258269990946,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:6368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,5535009887013723719,7878638615442426350,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:7264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,5535009887013723719,7878638615442426350,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:7272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7064,i,11188459335513452036,18346227075690798452,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:7376
- C:\Users\Admin\Downloads\watykanczyk.exe
  "C:\Users\Admin\Downloads\watykanczyk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7492
- - C:\Windows\SysWOW64\cscript.exe
    "C:\Windows\system32\cscript" C:\Users\Admin\AppData\Local\Temp\BB9.tmp\BBA.tmp\BBB.vbs //Nologo
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7828
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://lh3.googleusercontent.com/proxy/fMKwtl4hiN4C8667VtuyuHrdWpcLcxUmQJZ6upno9l0O5qAspg0IyykTIccmVDGz1tKeGrlr
      4⤵
      PID:7720
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7720 CREDAT:17410 /prefetch:2
        5⤵
        
        PID:3948
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://lh3.googleusercontent.com/proxy/fMKwtl4hiN4C8667VtuyuHrdWpcLcxUmQJZ6upno9l0O5qAspg0IyykTIccmVDGz1tKeGrlr
      4⤵
      PID:6780
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://lh3.googleusercontent.com/proxy/fMKwtl4hiN4C8667VtuyuHrdWpcLcxUmQJZ6upno9l0O5qAspg0IyykTIccmVDGz1tKeGrlr
      4⤵
      PID:8216
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:8216 CREDAT:17410 /prefetch:2
        5⤵
        
        PID:8304
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://lh3.googleusercontent.com/proxy/fMKwtl4hiN4C8667VtuyuHrdWpcLcxUmQJZ6upno9l0O5qAspg0IyykTIccmVDGz1tKeGrlr
      4⤵
      PID:8348
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://lh3.googleusercontent.com/proxy/fMKwtl4hiN4C8667VtuyuHrdWpcLcxUmQJZ6upno9l0O5qAspg0IyykTIccmVDGz1tKeGrlr
      4⤵
      PID:8584
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:8584 CREDAT:17410 /prefetch:2
        5⤵
        
        PID:8740
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://lh3.googleusercontent.com/proxy/fMKwtl4hiN4C8667VtuyuHrdWpcLcxUmQJZ6upno9l0O5qAspg0IyykTIccmVDGz1tKeGrlr
      4⤵
      PID:8792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6564,i,1163108978326420239,14145028577368423278,262144 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,5401341068290621067,8407353602638273868,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:9660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=3552,i,11878359459856362337,7117584552362510410,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3948,i,15222544977095553676,16562007847441341441,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:8
  2⤵
  PID:9456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7360,i,1954160556432898017,1318264411418390496,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:8340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,300821974711908313,15749888961657861061,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  PID:7180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7048,i,13576515192781772164,7123906627867011593,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,2749872884327412389,10754113538934839288,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:8952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,2749872884327412389,10754113538934839288,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=6996,i,158027524262768671,1475141009092415629,2097152 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:9308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,9200464942959384427,1903109166631573018,524288 --field-trial-handle=2340,i,11473059818341665194,7716871409401586862,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:9844
- C:\Users\Admin\Downloads\watykanczyk_killer.exe
  "C:\Users\Admin\Downloads\watykanczyk_killer.exe"
  2⤵
  PID:6452
- - C:\Windows\SysWOW64\cscript.exe
    "C:\Windows\system32\cscript" C:\Users\Admin\AppData\Local\Temp\5EF5.tmp\5F06.tmp\5F07.vbs //Nologo
    3⤵
    PID:4028
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:9616
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:10524
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:10524 CREDAT:17410 /prefetch:2
        5⤵
        
        PID:10620
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:10576
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:11080
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:11124
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:3660
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3660 CREDAT:17410 /prefetch:2
        5⤵
        
        PID:11120
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:5524
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:11836
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:11836 CREDAT:17410 /prefetch:2
        5⤵
        
        PID:12244
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:12108
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:12772
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:12880
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:12688
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:12688 CREDAT:17410 /prefetch:2
        5⤵
        
        PID:13320
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:11952
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:13812
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:13980
- C:\Users\Admin\Downloads\watykanczyk_trojan.exe.vbs.exe
  "C:\Users\Admin\Downloads\watykanczyk_trojan.exe.vbs.exe"
  2⤵
  PID:3552
- - C:\Windows\SysWOW64\cscript.exe
    "C:\Windows\system32\cscript" C:\Users\Admin\AppData\Local\Temp\7CBE.tmp\7CBF.tmp\7CC0.vbs //Nologo
    3⤵
    PID:2028
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:10508
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:10452
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:10452 CREDAT:17410 /prefetch:2
        5⤵
        
        PID:10936
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:10768
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:11944
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:12084
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:12736
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:12860
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:11856
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:8872
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:13584
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:13584 CREDAT:17410 /prefetch:2
        5⤵
        
        PID:13760
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:13672
- C:\Users\Admin\Downloads\watykanczyk_trojan.exe.vbs.exe
  "C:\Users\Admin\Downloads\watykanczyk_trojan.exe.vbs.exe"
  2⤵
  PID:9136
- - C:\Windows\SysWOW64\cscript.exe
    "C:\Windows\system32\cscript" C:\Users\Admin\AppData\Local\Temp\82AA.tmp\82E9.tmp\82EA.vbs //Nologo
    3⤵
    PID:6408
- C:\Users\Admin\Downloads\watykanczyk_trojan.exe.vbs.exe
  "C:\Users\Admin\Downloads\watykanczyk_trojan.exe.vbs.exe"
  2⤵
  PID:3948
- - C:\Windows\SysWOW64\cscript.exe
    "C:\Windows\system32\cscript" C:\Users\Admin\AppData\Local\Temp\8A99.tmp\8AA9.tmp\8AAA.vbs //Nologo
    3⤵
    PID:10328
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:10784
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:11380
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:11488
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:11796
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:11796 CREDAT:17410 /prefetch:2
        5⤵
        
        PID:12660
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:12588
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:13076
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:13076 CREDAT:17410 /prefetch:2
        5⤵
        
        PID:12752
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:13224
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:13476
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:13540
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://pl-static.z-dn.net/files/d6d/22a667e7dfa89dc569323c326d2505f5.jpg
      4⤵
      PID:14080
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:14080 CREDAT:17410 /prefetch:2
        5⤵
        
        PID:14228
- C:\Users\Admin\Downloads\watykanczyk_trojan.exe.vbs.exe
  "C:\Users\Admin\Downloads\watykanczyk_trojan.exe.vbs.exe"
  2⤵
  PID:10272
- - C:\Windows\SysWOW64\cscript.exe
    "C:\Windows\system32\cscript" C:\Users\Admin\AppData\Local\Temp\8D96.tmp\8D97.tmp\8D98.vbs //Nologo
    3⤵
    PID:10400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2260

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5960

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:17410 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:17414 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3808
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:17418 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:17424 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:5044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:17428 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:82948 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:82956 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:17436 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1812
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:148482 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:148484 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:279554 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  PID:6344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:410626 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  PID:6348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:345094 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:82984 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  PID:4532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:82986 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7580

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:6704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

Remote System Discovery

T1018

System Information Discovery