6b5f537885e7917f554ee73024d08728396ca71d7aa2a5cad760358feeb60a4a

Analysis

user interaction
yes
max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Locales/libcef.dll
Size 139.0MB
Sample260424-ejezcaet4y
SHA256 6b5f537885e7917f554ee73024d08728396ca71d7aa2a5cad760358feeb60a4a
MD5 57c329d856f32a9ef873cc84dfc4e6e5
SHA1 b1b2865f933e0c11b67ec25986e877ac82f87307
SHA512 c914e67e66613ddd731e8693dc812461324f367ae2978ae9b62f4e06e6cf8d6eb19a2d1064e6d7f31d5dd84f988178a4363b358b60df0a03c14762a007d85754
SSDEEP 1572864:4xLCIedOvL1RjnZrz+GzCFrkKLukZg0A3nNETALSjonU3aLKA6ADgQvEOGNVgd4Y:4vpJhKZotNDOpbYA
TLSH
T159689E01A523507DD89331B2346DFB2EAD3042168B2D7DD7EB985CD5BFE12D2263A287
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

System Binary Proxy Execution: wuauclt 1 TTPs 1 IoCs

Abuse Wuauclt to proxy execution of malicious code.

defense_evasion

System Binary Proxy Execution

T1218

pid	Process
1244	wuauclt.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SystemSettingsAdminFlows.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.offline.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\DDACLSys.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\SessionID.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\CBS\CBS.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\CBS	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\Contents0.dir	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\MainQueueOnline0.que	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setupinfo	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\BCDCopy	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\BCDCopy.LOG1	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setup.exe	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\setuperr.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\cbs.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\setupact.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\_s_34AE.tmp	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\PushButtonReset.etl	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\setupact.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\INF\setupapi.setup.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\cbs_unattend.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\setuperr.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\INF\setupapi.dev.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\CBS\CbsPersist_20260424040834.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\DISM\dism.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Timestamp.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\INF\setupapi.offline.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\diagerr.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\diagerr.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setup.etl	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\setuperr.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\setupact.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\diagerr.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\SessionID.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\setupact.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\ReAgent\ReAgent.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\actionqueue\specialize.uaq	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\cbs_unattend.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\_s_34AE.tmp	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\diagwrn.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.offline.20191207_091437.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\DISM\dism.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\setuperr.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\Contents1.dir	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\diagwrn.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Timestamp.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\actionqueue\oobeSystem.uaq	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\Contents0.dir	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\DDACLSys.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\unattend.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\BCDCopy	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.dev.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\setupact.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\diagerr.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\_s_3355.tmp	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\BCDCopy.LOG2	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\actionqueue\specialize.uaq	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\MainQueueOnline1.que	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\_s_35F7.tmp	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\_s_35F7.tmp	SystemSettingsAdminFlows.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2000	msedge.exe
5388	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214772871129814"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	wwahost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheLimit = "51200"	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheVersion = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\ = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperiencehos = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\N = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com\NumberOfSubdomain = "0"	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheLimit = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CacheLimit = "1"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost\N = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Extensible Cache	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperiencehos	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cloudexperiencehost	wwahost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cloudexperiencehos	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings	wwahost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CacheVersion = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\MuiCache	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\live.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage\live.com\NumberOfSubdomains = "1"	wwahost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3724	chrome.exe
3724	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe
Token: SeShutdownPrivilege	3724	chrome.exe
Token: SeCreatePagefilePrivilege	3724	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
5056	SystemSettingsAdminFlows.exe
5056	SystemSettingsAdminFlows.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe
3724	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5584	wwahost.exe
5056	SystemSettingsAdminFlows.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4800	4760	rundll32.exe	84
PID 3724 wrote to memory of 2304	3724	chrome.exe	87
PID 3724 wrote to memory of 2548	3724	chrome.exe	89
PID 3724 wrote to memory of 5388	3724	chrome.exe	88
PID 3724 wrote to memory of 2548	3724	chrome.exe	89
PID 3724 wrote to memory of 5468	3724	chrome.exe	90
PID 3724 wrote to memory of 5468	3724	chrome.exe	90
PID 3724 wrote to memory of 2192	3724	chrome.exe	92
PID 3724 wrote to memory of 3096	3724	chrome.exe	93
PID 3724 wrote to memory of 2192	3724	chrome.exe	92
PID 3724 wrote to memory of 3096	3724	chrome.exe	93
PID 3724 wrote to memory of 2932	3724	chrome.exe	94
PID 3724 wrote to memory of 2932	3724	chrome.exe	94
PID 3724 wrote to memory of 5672	3724	chrome.exe	95
PID 3724 wrote to memory of 5672	3724	chrome.exe	95
PID 3724 wrote to memory of 1060	3724	chrome.exe	96
PID 3724 wrote to memory of 4972	3724	chrome.exe	100
PID 3724 wrote to memory of 4972	3724	chrome.exe	100
PID 3724 wrote to memory of 2000	3724	chrome.exe	107
PID 3724 wrote to memory of 1512	3724	chrome.exe	108
PID 3724 wrote to memory of 4404	3724	chrome.exe	109
PID 5532 wrote to memory of 4936	5532	msedge.exe	121
PID 4936 wrote to memory of 5572	4936	msedge.exe	122
PID 4936 wrote to memory of 2000	4936	msedge.exe	123
PID 4936 wrote to memory of 2300	4936	msedge.exe	124
PID 4936 wrote to memory of 2300	4936	msedge.exe	124
PID 4936 wrote to memory of 2300	4936	msedge.exe	124
PID 4936 wrote to memory of 3612	4936	msedge.exe	125
PID 4936 wrote to memory of 3612	4936	msedge.exe	125

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Locales\libcef.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\Locales\libcef.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8e064c728,0x7ff8e064c734,0x7ff8e064c740
  2⤵
  PID:2304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,10602019374315133503,1597146819917642632,524288 --field-trial-handle=2020,i,6626720689138326570,13142673964611460115,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,5490376272754221300,1185613187631362307,262144 --field-trial-handle=2020,i,6626720689138326570,13142673964611460115,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:2548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,9213596693300297546,6312189545840737389,524288 --field-trial-handle=2020,i,6626720689138326570,13142673964611460115,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2140 /prefetch:8
  2⤵
  PID:5468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,10671550322912933357,6500816800361985786,2097152 --field-trial-handle=2020,i,6626720689138326570,13142673964611460115,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3264,i,9432795995231759910,15596379734948231637,2097152 --field-trial-handle=2020,i,6626720689138326570,13142673964611460115,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,2018515646253635401,11965245487656200744,2097152 --field-trial-handle=2020,i,6626720689138326570,13142673964611460115,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4744,i,7889131890034536353,13943783592423557179,2097152 --field-trial-handle=2020,i,6626720689138326570,13142673964611460115,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,13342462419788028857,15472231757687143310,524288 --field-trial-handle=2020,i,6626720689138326570,13142673964611460115,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5772,i,5857642099248870525,11698220846709310908,2097152 --field-trial-handle=2020,i,6626720689138326570,13142673964611460115,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3496,i,7105382420211154163,78358080347401308,524288 --field-trial-handle=2020,i,6626720689138326570,13142673964611460115,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,6357041102587077749,1178365389985413049,524288 --field-trial-handle=2020,i,6626720689138326570,13142673964611460115,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3464,i,6969034017856802213,10882642839149504790,524288 --field-trial-handle=2020,i,6626720689138326570,13142673964611460115,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:4404

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1888

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault0cd23751h9ec0h4eb0hb483hbd540b3b82e2
1⤵
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault0cd23751h9ec0h4eb0hb483hbd540b3b82e2 --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x248,0x7ff8df4dc188,0x7ff8df4dc194,0x7ff8df4dc1a0
    3⤵
    PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,16699648918653173582,12235993036249176613,524288 --field-trial-handle=2296,i,6883382547436823214,11324841182765001015,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,10623138479248207381,1075272659944660482,262144 --field-trial-handle=2296,i,6883382547436823214,11324841182765001015,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,17320655600313933169,17428873048781522159,524288 --field-trial-handle=2296,i,6883382547436823214,11324841182765001015,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:8
    3⤵
    PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2224

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5584

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDevicePortal
1⤵
PID:3408

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDevicePortal
1⤵
PID:5972

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" FeaturedResetPC
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5056

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:5000

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4564

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2640

C:\Windows\system32\wuauclt.exe
"C:\Windows\system32\wuauclt.exe" /UpdateDeploymentProvider UpdateDeploymentProvider.dll /ClassId 85d6acb2-2f6d-4034-9a82-9540f7143d69 /RunHandlerComServer
1⤵
- System Binary Proxy Execution: wuauclt
PID:1244

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setupact.log

Path C:\$SysReset\Logs\setupact.log
Size 104KB
SHA256 344eb810aa178cd2fd5cdd18f35e06eb1401bd0747880ac25c6f98ddd4cffa02
MD5 71386bed32355ceb206c25fce41dde98
SHA1 06fd9c083fc9f0bc15adb74b311b423cced97064
SHA512 dff0ff562ef7baa85bea3dc57e721655cff5cb09cde51b38016502aa6274d5f884ceb6974225c7ea60052e17ee126666c824e610857bc22ccd29bab086c4f8f9
SSDEEP 1536:WFPuaiprxOiSLNxNhyE/SUiKAeLsI8hZSDsueOpjzTc0xdtoyc2dz4Wn6NVmvcRP:W+H
TLSH
T197A339230BBAC1F1B718C551B7914BAE6316F44132C8A31A777ED163BF822A1D7F8649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\$SysReset\Logs\setuperr.log
Size 749B
SHA256 8caa64b041bcfa41491364374b4e78b6d2a141d4f7ca0ec128487c005f555403
MD5 949dd184ee248627c5cb14cba5c0a66d
SHA1 877dd2fd778d87fffceae8a559bc921c6cf9285f
SHA512 e7944801771885fba312a9c345469e14f8d7a7697af401e3d98cc13560f4ee12876d24efc5043a888311ebeac3bb9331d696676ca1d066026c08f3fd76fe61e4
TLSH
T1B9019E4759EA45A7D1B021207D41B77C1EC174E350C8CA2A33AD5AE5F7420F0B9FB28A
MD5 SHA1 SHA512 TLSH

Submit Download

692c1493-9d80-4201-9fb6-5cce7d646a84.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\692c1493-9d80-4201-9fb6-5cce7d646a84.tmp
Size 195KB
SHA256 27ae25855ded2c948ae58c7882fceb5b0c1dc63a092424a682c1ac790fae6de2
MD5 ff1f178c1df558f670f04512d321b9db
SHA1 e9491ab92a37ed754d2ea97d48e4fe5e6f968339
SHA512 b8c9667cd626da6cc24541a76c81525475d6ac202934ef0fdbd1898e339e55968b31f1db3f16f5e0fe4ce88f33c9c434831f443da2d2cfcf80156156889c1090
SSDEEP 3072:1Zj8Gy1a4Y9Xk159Xft2IMiBcKNhD3Qw/xLANk0mUW5GmRntSFCjEENU:1CZgk7lMiBcKPDrOk0HOGm/SFyEE+
TLSH
T1B11413292F0B0FBE6ABF47217E5F7C1F4D214246B19F2998626D1B8851C518C2F32E76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 65f6dde2b270b327610555b79ee93f848bd875bea264576872273cd6bfe49ba6
MD5 269539ed5e58dbf556509be1cc44f65b
SHA1 80a7a37ae6e0b6a6b89d72af949027695f50ee35
SHA512 498c7d337ccdd29c0d7bd483f3fb9e021a78c9a208611a2e00364d65477ccca3c0a26ac27ded2fb51dc3a50eef7a2a2089d3a3afdf81bda77c6797c5db2e2833
TLSH
T1AEE02BAAC931EC2B18FD1B6871484645E64413463B40495F3E3EC10C8FF863A4182C1C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 7b5b670ca0d0bf9956ccb8f50e9190619323663d022e6968e64e3e2827befac7
MD5 93833beafbac5d5d63d76db7fa7bf8c4
SHA1 d2abb5761d558ffddbda537e5fcee908da216af2
SHA512 80a345fa8928f12b76e3ee7f946d6e120387395b4992abbc2ffc3e8c29b7ef25dd89e8b1e705d04160684e7d938b65a0c7c11aa5468cd2975101f9acfe523d0d
TLSH
T154C092E2A250D691EF9805B928621522A66684F82AD3025D60E5625CAA027B14213A47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 2403d37ea01de272e8d3f7075ffc45ccc5483257cd07760fe7de2e7c507a6624
MD5 cf2636a62b2f5e46903a0c0c55695a67
SHA1 d63dd208ad303e160946e0d07cb875a027c0c931
SHA512 420aa24226c8948ad2e507991fd5339a6c3cabc609c63895b0391cfcbf19f4a656b908f251a0b7350ae9e2d0254d4777273df7a09f03cb8b7af22da95999e1d1
TLSH
T18C819DF7C3E8C62D855156F4AB256E2FCE2D0924532C3C66C8D4AF5B63E2972D21134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 f729464e1fb5af1a282cf10b00c990cbfbcb958d25a0b5c560053737f79c718f
MD5 ecddf3c0cccbdd8f55690d6b5583f8c2
SHA1 a7d3d9e30ae843c35796f3ea0cf4ec21b0c54de9
SHA512 97818bca19aaf9320aa15f5c75699eb062a11af91459a6f7ac28c7ce14623963aeda6ac072f6ec334c56ecf97a5e4f2dbbe57c8e1bb67b5c4a6170ee1fa7afa6
TLSH
T1F0F050AFA779741B10F9456B3E14B809AC75943003C038E0CEAB415CB0C66FB0F06413
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f4d071a7a0f543d32719349032ea6636090a1b14e8d067c915bce4ca71288c84
MD5 f764c345b32b78a5c6649bab95e38b59
SHA1 5035470652d9b3928933aac5a5831c5ed853c087
SHA512 99e056c6ff0f78855dda8984f5eb98e25866c0e1f4c40ce5bef6cf55bc12759a6740ddcb122148de0f80e450520125de52f9ec12a1c161a8f67540353bc553ad
SSDEEP 192:FRPro6Id9damzv7tYhAPRp2h0My9CHsb+WNn8IN7hIW2KkfcedbxcVyIsnAUgtaJ:FRPraLhY8XeNy4w8+NJ2jfbV48
TLSH
T14D42E82EAD10693B4CCBD229FD757B67D7F6102162D81E94EAFC8A2C15DB5CC222710B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 e3e85507733b74e650902d1645f4c8e2a47131f5f4d003efbf580d80d51d1e18
MD5 d25832a19ff9c1c57c95ef5ecf3d457d
SHA1 30d5ae73ddd9dfab1127bd841aef79ad540016fb
SHA512 680876039281bd13201af5a0d12b9eed3257e3547eb60a743076a4ef44ddf64d39464fedf9d363ec15f80fae0d8dd3610e3a09d4d4a9512ce92d01878e2ab95f
SSDEEP 384:S0jWV7KxkXqKf/pUZNCgVLH2Hfgslvy7pLuLcifcdXODW1+ErU3IQHGtHkr0:SYWV7KxkXqKf/pUZNCgVLH2Hfgshy7pd
TLSH
T15372D8676C4C99370F94C6CCDC167E4FADB6024B65DD886893FA582A03D5ACF120A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 bfc76d297730832f7a5c7d4c55234e8ea19db6a0e4b5393e79cc724098556000
MD5 17e2b8f1542abbdc27882568bb9428b7
SHA1 55ba9a26836cf75b8cc35d773c8ea4d0ffbeec64
SHA512 97a68e74c6d548bdf0b7b3b96e68d6297245aa610beadb9c697d9476e75d7702555771f64020e80102483aaa01f7ca170cbcf6a89f076df5f07523234c317a07
TLSH
T119B012508401AD52C00702F429C2048832149F21C705230253E0A971A8365D14034250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dd0d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58dd0d.TMP
Size 96B
SHA256 e3bc2cc5a9b45c3bfa102ce9d3caa503c26c056108d7d2f360495e82f4aa71b8
MD5 04cd9100c3b66d4617b6362839b44525
SHA1 3785c54a3ebc2753c11c10cd1e944750b6ab94b2
SHA512 e160a59d67d9b778f7cb7e499c445a38faa57ced81cb9958052368f818c0a4ad3e9e001c7c5352423d33dae1931889cd219f84c28792b9178d7816a96f64d26c
TLSH
T13DB02200C003E20AC00203B028E880CC3020CF20CB030202C3E00FB2FC203200330320
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 8ceca3f1674004c6942e411a9bb00aa962623e8202086d867a9ec122975b6a58
MD5 51e02a65cda7bc01c0f9f506a8c4a2e6
SHA1 056c7698e7da89a1b137882fa0d1859409bc6c40
SHA512 cf2eeab5a9b124849ea65cb5118e3dac46aa56d9e5443689f45a46ba8537151ff18204dc42c9c2bfc4fdca7b7f27f83ee5f6fd990455d67257a2e696391c51bf
SSDEEP 1536:0NvcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:Iv3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1FC9312BA4E1A46EB957E4AC176AD7808CE12130D70AFA9CC316C639D61941C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 2ba9e05d6eae28d2d2d57aec59937b5efd31dc1aa11497ea9c29e64c2b070697
MD5 ceccbf88afbd275aab2f053d0f37cc03
SHA1 17491bd102ec4ad1b1944dbf5fd35eae21c111c0
SHA512 9ea25b57dbdba6be71d6acec610786e7b6fc95d91e936e22b617875862262850edd47fe791c177eaa02348751295b632243d4f7b28e947a3c7e7d631c2857569
SSDEEP 3072:aZj8Gy1a4Y9Xk159Xft2IMiBcKNhD3Qw/xLANk0mUW5GmRntSFCjEENU:aCZgk7lMiBcKPDrOk0HOGm/SFyEE+
TLSH
T13B1413292F0B0FBE6ABF47217E5F7C1F4D210245B19F2998626D178451C518C2F32E76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 f75d259e76320fc9fcaf74d054e10155fb55676e54b1b213fe39a23081e4a0b2
MD5 044c48f9b48209e24b1bbda4083bd0a0
SHA1 92dc920050998e6b4543d4f539682a4663e89e7b
SHA512 ebe49abeb795d11a7dcf7a12ebfc8170a6fa9c1151a16ce8696802a493d6d3fef0820d6d8e482c084906c90ab776218d5a92ee11e98a45c10871a44e12e5968b
SSDEEP 3:MsEllllkEthXllkl2zEklUIY:/M/xT02znUI
TLSH
T1D64404447FC0C545DD0030344013D3700374D45005515F4334D344135FC55410C11001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f0f1b711c298ec3410322f666710b6871c33418732034be6eeef3c8f312cdd5d
MD5 479b3f73847a44b28c9db6aa51f5d2a1
SHA1 069be6fd05d3b9109e6c9059750fb2459cc740e5
SHA512 7b7aa2b2e7adf83d4f25fc9178431acc9ad44787ddd4eb6dbbb5f76ac47a76cf5af8a30223f7e9b3f56ccc0c1bfba695a9e5d6fae9c10d5184b7c9fc54a5775f
SSDEEP 192:sxZvyRVQmsGfVgkvqrjOxMIrpLHW6+WNGYKZmIphgiMJ:sxZvykmsAmaiaNLHbGJmJiw
TLSH
T14832E8466D28983B4CC7E619BB6A7F93D3F91122A1C15E4C9AFC8B0C04DBADD221741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 3f0a47b7ffa8e1782e22d1aa07084d728c8516f8a4f0f7b4bcd149f888a879bc
MD5 4d005435d55b94882c84d0d8ca83ea8d
SHA1 42bef6fc506fb55b00c1e3245c23ff7238495b7a
SHA512 5a36267d9a126dce086afaa19bcc1d7c1033224b57791af14156e576ab2ac8f89c48d56819e86accc6436e656585de372f3d83139384f0c49026878b824ae25a
SSDEEP 768:DxCLIAo7pLuL/2eWvaSwq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZMSJLlhzCrUroA:DxCLIAUE/2eWvaSwqu1jaIMSJLDOr/A
TLSH
T161E2EA3B780CCE7E4F800A9CDD1A7F8F6EA802CB9698C95447F9845C02C67EB55260DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e07adbff8325d91a653cf748edf99121e56abac7c081a97dea216a5158be7185
MD5 8247d84eaf901fc480e97e4a3b479cd6
SHA1 a6e44cfdfa25f9cdb1dfc545647ebf2834185305
SHA512 d58d356d2b92ebb56c6fdb91c19a7c01fd62d48e97625a171eec68547bdc22f66599795ce65f914fa7979e7a05a0f2062f05809bbe6acf7a069403ab0e091de5
SSDEEP 384:nPiFavqMg3sNqw8TUNTUlIm2ZTPENd6O+fjYuD3JenSRYV/Vw1mR77i4rN1k+5vf:aFayv3BwwgH+kYy34SRYk1mt7Bv
TLSH
T102C24B36E8A8DEABEDE68FD5AB0ABA07DFE011A7C58845D4DAD40D1D00D71DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e630907d3dd2598f34042204e33b577c7fef41437a4f1dac3828ee2fd803b554
MD5 2ea98c1e3db89602c95f9a2afc2883d9
SHA1 3f6dda9b46c22d174740d9997685833e21812278
SHA512 f7eafa90ba7cdf2652f15b8306f247e9cebe894b279a4df8e492ecb3079f65c259c290920a88d41b67f812c0a041aab3d785cf1dfb27ec0f880a4e3bc62c1a18
SSDEEP 384:nBiFavqMg3sNO8TUNTUlIm2ZTP1a8O+fjYuD3JAtZ5tFxRYV/Vw1mR77i4rN1k+t:oFayv3nwgHc+Yy3MxxRYk1mt7Bv
TLSH
T1ADC25B36E8A8CD6BEDEA8FD5B74A7A47DEE001A7C98C4AD4D9D40E0D00D71DE170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sessionState.json

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\LocalState\_sessionState.json
Size 136B
SHA256 0e9674b55a602a97e8ed235ec72e98e5d816ac014684d179a1fc0b9959345d97
MD5 9c1e824ef8695a1abc67f5d0a95778c0
SHA1 ec43ba5ce45d92453320bd6d14d96a866ed4c0e9
SHA512 55e92e224e5d357e4c1dfcd34ee8b7e1d160f8edfce2f3bd156a240f4cc8c73b3329497d8199fabf2a81d8d04be5f49687224b498c57cb115231b47c81d65d15
TLSH
T12CC02B052D10083489C0CC864C0D01304F101300A6CC5BD892EC0454D84022CE21C80C
MD5 SHA1 SHA512 TLSH

Submit Download

diagerr.xml

Path C:\Windows\Logs\PBR\Panther\diagerr.xml
Size 9KB
SHA256 ac4584c88c9d446f9a94f2770088bab1cd2a3609b5c9ecf81ba09d22a5dadf36
MD5 35bff6b6a8f69b03488445baa2565037
SHA1 9c6eb76dc978c117243ab25293917a81184479ae
SHA512 564396c95b56cc9e727364c17f0e5affd4d7b16a6fb5ab98e2ce67b1587a7fcfdeff9b257dd73bc16219bbf594a401d20c764e5838937e7a901d8917da215361
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnHBHMwiGdgbneLHMwiGdgbnt:53gbq3gbq3gbHh3gbq3gbt
TLSH
T1CC129429B1992EBB5C9446F9DFD038C26F8097794106A03395C4FDAFB279082F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SessionID.xml

Path C:\Windows\Logs\PBR\SessionID.xml
Size 106B
SHA256 bee5c716377b3de5d8c5c30e12c7fac2656cffd0a47f96f547cc4b71b8a19f11
MD5 159bdce79757de2d7fafc307734aa3fd
SHA1 9ed233a865c5b74c284a3620e60566335d749e90
SHA512 a9350b9539821a5c6d5e4566318c3e1330cf611c9dc7ec5601148e1bf07d4516bc32cdf8393e92d19516e4c45d9906e70b2c58d34b1902ed1d62a71fc1cf1eb1
TLSH
T1BDB012C460A0A0F01189CABA87B710D10BF0359110E053C6B97D2315038EA6D2F9870C
MD5 SHA1 SHA512 TLSH

Submit Download

Timestamp.xml

Path C:\Windows\Logs\PBR\Timestamp.xml
Size 42B
SHA256 4128b3ccad2ca70789941a3f19540ca8e8309a9317af74d5e1a1722a63970b7e
MD5 3b4e84e120b6aba39b4f28408627000c
SHA1 29e7b82ca1d0ff5ee3b424991a60b77c2c9b2c10
SHA512 a6bf30392a179ddbd634af75538ef26592976728b52e5851c924c7b80986ddd9aca01cf21c8140fe837165c7b63dafe051e0515de3e99fa6649d56eb75756eef
MD5 SHA1 SHA512

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 10KB
SHA256 343b674e4ca4a76b3ccffd38464a11cfb3cd1dc5f05dea71c90e9f322378d517
MD5 c5fb1960fef43272404796798f969570
SHA1 5b654a10c93b1a497b58e04c738bb6ad27d17693
SHA512 28355abaa53e7279e64fe4fc34f44dd5e3fbad0d8e9dd38e59ed9a4370a6ed59a2d2da91456fd08e96cfe2a4e45e35691f20aba0fc531d616d7c068d7eaed16f
SSDEEP 96:5MwiGdgbneLHMwiGdgbnEjgCcZZjwjFjHSHMwiGdgbnYMwiGdgbneLHMwiGdgbnl:53gbq3gbE7cHcJ83gbY3gbq3gbEQ1Dk8
TLSH
T1B632D639B1A42EB75C9046F8DFD038C26B8097794116A03795C4FEAFB279082F5B17DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4800-0-0x00000000049F0000-0x0000000004AC3000-memory.dmp

Download

memory/5584-302-0x00000227972C0000-0x00000227973C0000-memory.dmp

Download

memory/5584-301-0x00000227972C0000-0x00000227973C0000-memory.dmp

Download

memory/5584-507-0x00000227ACB00000-0x00000227ACB20000-memory.dmp

Download

memory/5584-581-0x0000022799690000-0x000002279969C000-memory.dmp

Download