fb4de6688600bc8149c54e81a50e25383bc3beb0ad8c49a77133d9e6efa1e076

Analysis

max time kernel
92s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f389cf54.exe
Size 2.9MB
Sample260702-pdrfasf19n
SHA256 fb4de6688600bc8149c54e81a50e25383bc3beb0ad8c49a77133d9e6efa1e076
MD5 e267458a180d667e1cd6d57aca39618a
SHA1 833c5f322b15023758f2130a8c6b2e0bf54f0ebb
SHA512 e095ad9322333eab9f7718d465972be629f10c01b3dc5863a77fb214e85175b286627f873f6472fda7cf19a7a624f8ae67e12dd56e7ef7828a4d33d134a15261
SSDEEP 49152:SwuzqQUe5OLxzNfE5Vp9bUtg2m0yUJLeZlF3TeNgJksl1k4M:huCz5CRphNkj
TLSH
T11FD59E0BACE109F9C496973288B611937B35BC590F3627D72D50B2782F72BE0AD36794
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware credential_access discovery persistence ransomware spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 3168 created 3896	3168	f389cf54.exe	88
PID 3168 created 2368	3168	f389cf54.exe	89
PID 3168 created 2528	3168	f389cf54.exe	90
PID 3168 created 2752	3168	f389cf54.exe	91
PID 3168 created 4092	3168	f389cf54.exe	93
PID 3168 created 1732	3168	f389cf54.exe	95
PID 3168 created 3592	3168	f389cf54.exe	94
PID 3168 created 3896	3168	f389cf54.exe	88
PID 3168 created 3896	3168	f389cf54.exe	88
PID 3168 created 2752	3168	f389cf54.exe	91
PID 3168 created 2752	3168	f389cf54.exe	91
PID 3168 created 6108	3168	f389cf54.exe	112
PID 3168 created 4628	3168	f389cf54.exe	113
PID 3168 created 1896	3168	f389cf54.exe	114
PID 3168 created 3128	3168	f389cf54.exe	116
PID 3168 created 5772	3168	f389cf54.exe	117
PID 3168 created 2348	3168	f389cf54.exe	119
PID 3168 created 1424	3168	f389cf54.exe	120
PID 3168 created 476	3168	f389cf54.exe	121
PID 3168 created 6108	3168	f389cf54.exe	112
PID 3168 created 6108	3168	f389cf54.exe	112
PID 3168 created 3128	3168	f389cf54.exe	116
PID 3168 created 3128	3168	f389cf54.exe	116

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3168	f389cf54.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2752	chrome.exe
3128	msedge.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	f389cf54.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	f389cf54.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274680096554723"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{DB7B94AC-EFB4-4C35-9614-83DC18ED199C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{E5524127-5E11-4A81-B81C-3BA4818B3D43}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{8DD28543-E138-444C-AEDE-4375A75919F2}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3896	chrome.exe
3896	chrome.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
2000	explorer.exe
2000	explorer.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe
3168	f389cf54.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe
6108	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3168	f389cf54.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	3896	chrome.exe
Token: SeCreatePagefilePrivilege	3896	chrome.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe
Token: SeCreatePagefilePrivilege	2000	explorer.exe
Token: SeShutdownPrivilege	2000	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
3896	chrome.exe
6108	msedge.exe
2944	sihost.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe
2000	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2156	StartMenuExperienceHost.exe
4232	SearchHost.exe
2000	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 3896	3168	f389cf54.exe	88
PID 3896 wrote to memory of 2368	3896	chrome.exe	89
PID 3896 wrote to memory of 2528	3896	chrome.exe	90
PID 3896 wrote to memory of 2752	3896	chrome.exe	91
PID 3896 wrote to memory of 2528	3896	chrome.exe	90
PID 3896 wrote to memory of 4092	3896	chrome.exe	93
PID 3896 wrote to memory of 4092	3896	chrome.exe	93
PID 3896 wrote to memory of 3592	3896	chrome.exe	94
PID 3896 wrote to memory of 3592	3896	chrome.exe	94
PID 3896 wrote to memory of 1732	3896	chrome.exe	95
PID 3896 wrote to memory of 1732	3896	chrome.exe	95
PID 3896 wrote to memory of 3952	3896	chrome.exe	96
PID 3896 wrote to memory of 3952	3896	chrome.exe	96
PID 3896 wrote to memory of 3924	3896	chrome.exe	97
PID 3896 wrote to memory of 6040	3896	chrome.exe	98
PID 3896 wrote to memory of 6040	3896	chrome.exe	98
PID 3896 wrote to memory of 4948	3896	chrome.exe	99
PID 3896 wrote to memory of 4948	3896	chrome.exe	99
PID 3896 wrote to memory of 6048	3896	chrome.exe	102
PID 3896 wrote to memory of 5624	3896	chrome.exe	103
PID 3896 wrote to memory of 1808	3896	chrome.exe	104
PID 3896 wrote to memory of 6048	3896	chrome.exe	102
PID 3896 wrote to memory of 5624	3896	chrome.exe	103
PID 3896 wrote to memory of 1808	3896	chrome.exe	104
PID 3896 wrote to memory of 3648	3896	chrome.exe	106
PID 3896 wrote to memory of 3648	3896	chrome.exe	106
PID 3896 wrote to memory of 2756	3896	chrome.exe	107
PID 3896 wrote to memory of 2756	3896	chrome.exe	107
PID 3896 wrote to memory of 5628	3896	chrome.exe	110
PID 3896 wrote to memory of 6136	3896	chrome.exe	108
PID 3896 wrote to memory of 5628	3896	chrome.exe	110
PID 3896 wrote to memory of 3460	3896	chrome.exe	109
PID 3896 wrote to memory of 6136	3896	chrome.exe	108
PID 3896 wrote to memory of 3460	3896	chrome.exe	109
PID 3896 wrote to memory of 200	3896	chrome.exe	111
PID 3896 wrote to memory of 200	3896	chrome.exe	111
PID 3168 wrote to memory of 6108	3168	f389cf54.exe	112
PID 6108 wrote to memory of 4628	6108	msedge.exe	113
PID 6108 wrote to memory of 1896	6108	msedge.exe	114
PID 6108 wrote to memory of 3128	6108	msedge.exe	116
PID 6108 wrote to memory of 1896	6108	msedge.exe	114
PID 6108 wrote to memory of 1896	6108	msedge.exe	114
PID 6108 wrote to memory of 5772	6108	msedge.exe	117
PID 6108 wrote to memory of 5772	6108	msedge.exe	117
PID 6108 wrote to memory of 5484	6108	msedge.exe	118
PID 6108 wrote to memory of 5484	6108	msedge.exe	118
PID 6108 wrote to memory of 5484	6108	msedge.exe	118
PID 6108 wrote to memory of 2348	6108	msedge.exe	119
PID 6108 wrote to memory of 2348	6108	msedge.exe	119
PID 6108 wrote to memory of 2348	6108	msedge.exe	119
PID 6108 wrote to memory of 1424	6108	msedge.exe	120
PID 6108 wrote to memory of 476	6108	msedge.exe	121
PID 6108 wrote to memory of 1424	6108	msedge.exe	120
PID 6108 wrote to memory of 1424	6108	msedge.exe	120
PID 6108 wrote to memory of 476	6108	msedge.exe	121
PID 6108 wrote to memory of 476	6108	msedge.exe	121
PID 6108 wrote to memory of 544	6108	msedge.exe	122
PID 6108 wrote to memory of 544	6108	msedge.exe	122
PID 6108 wrote to memory of 1952	6108	msedge.exe	127
PID 6108 wrote to memory of 248	6108	msedge.exe	128
PID 6108 wrote to memory of 1952	6108	msedge.exe	127
PID 6108 wrote to memory of 248	6108	msedge.exe	128
PID 2944 wrote to memory of 2000	2944	sihost.exe	129
PID 6108 wrote to memory of 4976	6108	msedge.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\f389cf54.exe
"C:\Users\Admin\AppData\Local\Temp\f389cf54.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xc0,0x134,0x7ffc92f9c728,0x7ffc92f9c734,0x7ffc92f9c740
    3⤵
    PID:2368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1640,i,16942558905142184487,12577887392443129951,262144 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:2
    3⤵
    PID:2528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,13707579793420322853,120211850126281493,524288 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=1988 /prefetch:11
    3⤵
    - System Time Discovery
    PID:2752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,8161393124711218244,11314416785118337753,524288 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:13
    3⤵
    PID:4092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2972,i,3590493705021204790,5730216421411227619,2097152 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:1
    3⤵
    PID:3592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2980,i,13249900062370684113,6628753489932211537,2097152 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
    3⤵
    PID:1732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4588,i,14901863944329209273,4703674435770397911,524288 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:14
    3⤵
    PID:3952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,2027235795021016053,1643706176741182062,524288 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
    3⤵
    PID:3924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5420,i,3630965707965793425,8677023305132434475,2097152 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:6040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5432,i,10720424333552409070,5342708955926557925,2097152 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:4948
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5716,i,9734481010843469704,15867680014812723988,2097152 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:6048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5812,i,11795236411395861392,12624328362784982720,2097152 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:5624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,2044176712957456250,13043172363549990770,524288 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
    3⤵
    PID:1808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5944,i,13480607853017415185,7459928592456856546,2097152 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
    3⤵
    PID:3648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5472,i,13280901487001933391,8402504662801386680,2097152 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:1
    3⤵
    PID:2756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,5905315726388579952,11187061731056661281,524288 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:6136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4720,i,10742232508097045098,11362593127518732713,2097152 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:3460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4728,i,13607396683604865320,12792979261950333483,2097152 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
    3⤵
    PID:5628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4580,i,9859656724866128305,16445038694820977374,524288 --field-trial-handle=1960,i,11034106429173809883,8707034147438615058,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
    3⤵
    PID:200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffc7f09c188,0x7ffc7f09c194,0x7ffc7f09c1a0
    3⤵
    PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1676,i,3431953916992901841,3107763452690558392,262144 --field-trial-handle=2360,i,4905383914780833216,5844072649480282855,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,5567017816875182114,12836214009958984086,524288 --field-trial-handle=2360,i,4905383914780833216,5844072649480282855,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,18435160402394072371,12389129942923442239,524288 --field-trial-handle=2360,i,4905383914780833216,5844072649480282855,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:13
    3⤵
    PID:5772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,6459659223183184105,14968009052159495979,2097152 --field-trial-handle=2360,i,4905383914780833216,5844072649480282855,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:5484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,2335791268039269127,11734460221284293529,2097152 --field-trial-handle=2360,i,4905383914780833216,5844072649480282855,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,4922908740438283529,4197049179946326314,2097152 --field-trial-handle=2360,i,4905383914780833216,5844072649480282855,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,18389359989476580102,7384889850085490982,2097152 --field-trial-handle=2360,i,4905383914780833216,5844072649480282855,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:9
    3⤵
    PID:476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,2794717266618015689,8774209644461468361,524288 --field-trial-handle=2360,i,4905383914780833216,5844072649480282855,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,16378142836414629282,13891073448057526677,524288 --field-trial-handle=2360,i,4905383914780833216,5844072649480282855,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,18131687173260813099,13863331532723662059,524288 --field-trial-handle=2360,i,4905383914780833216,5844072649480282855,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
    3⤵
    PID:248
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,974495312992652629,6172306906967465627,524288 --field-trial-handle=2360,i,4905383914780833216,5844072649480282855,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,974495312992652629,6172306906967465627,524288 --field-trial-handle=2360,i,4905383914780833216,5844072649480282855,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,9833434883061159153,7994319174066015338,524288 --field-trial-handle=2360,i,4905383914780833216,5844072649480282855,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
    3⤵
    PID:6596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,11091659250508795539,10219379529819434521,524288 --field-trial-handle=2360,i,4905383914780833216,5844072649480282855,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
    3⤵
    PID:6848

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1800

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2000

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2156

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 e191993e6b1caacb59ccc860126ff33b5fa9163e6c3f03d19ad55a6e7cc7b3f7
MD5 29313030fc04fb9f6810ba6789d01998
SHA1 0a421b15cd05618ec7be3a1d6131e5668b11ab77
SHA512 737f30330c65f80788219659e5fc046d196d4a4cd2cc8025dc0f67fdc6464e77b37f1be677605bcf0d2f327b0bd1af4d25ca57ff190c2e98247f4a507c90ef6b
SSDEEP 192:/3RYgBb8v7zlvAPRp2y9XHsb+WNnIGPp2ewCHVyIsnAUgR:/3RYgpol6XJxw1P9hR
TLSH
T1EF22C76EA914253B5CCBD22AFF717753EAF6102235D42E84EAFC8A2C11D79CC2213427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 ffb0d8c31db144a94b27b15e0ba75f87673d4d06eff8d2ed1307cb15fcc50130
MD5 2f2b55c6d91c14dadf482380e0e65411
SHA1 a438d75bf7a2d56b871a8e0567ddce7f9db33c82
SHA512 706dcc3d7de19a7c3bcde5119d6985763ebd2689d20cda876da2f5b795aaadabce8e210f0a76962047d9dddd48f2a6381c6abd1cf05082d0f098bf56f84dec74
SSDEEP 192:ewL4K6th7KxkXqK4I40pUZNCgVLHrKHfFKslEAZP5XzKD/+5+ErUkKN93fmH63H4:RLjGh7KxkXqKf/pUZNCgVLH2HfgslV5T
TLSH
T1CF32D72BA48D9E7F4FD8D41CDC522F8BACF5029672680D2496FB9D0803A57CE115B2B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 db0fba1f0d28b6fa35d958163a56ce8454fd3dd82ec0b21623147c3d5c77d56b
MD5 12895499347ca6f28dce28caf70f0845
SHA1 41109760828b36b5b15574b2767b6826af938094
SHA512 4d2052581ee582ec5f7a46b29b094c173f2799497d18debea7f596b6d0c87b89ab59b96596369728c0264ed42a80e30e1660eede9d258814c399735278db7d18
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OlemSVumbn5:1nbZeMrv/hGtQmGn5
TLSH
T192D3874F3A743002EDE59A761CE051BB5D3CB16D8F5595D438B620588EF2863A23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 029667bfefb78811981aca4433f88b9bd70a8bb710e08e8f54647a53885ed695
MD5 61cca1625cda0cd69fd9cce2bf1deeb3
SHA1 2af2bf71587bc414074da76176b23620a85cc5d7
SHA512 1ba123132de28e720c398dcc579ea35098c2216ed60a2b69ac460c46ba8a50aa6ef51aeba8603751ac79c3514220b59f4caa497fa591507b26a0890aa51ed623
SSDEEP 96:VC68d+laPzyON3b/fVvMxRRDotok5WODrB6VddGyvvwjN9wb7v4a:VCPmaPzyONr1vmDUDlVQdwJjN9wbf
TLSH
T1E7A11972A028DD3759B6D885B2576F838FB4616BA621DF98D9EC2F0C12F71EC0302523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 91330d5c0f9efce114b54fcb8cf3a5a27b09d10a6c89ac58552e11aa5faf10d9
MD5 a64e7e84fedae191c98c02feb5a51829
SHA1 63fe0534392bec2429a87070e5acd0746a23614a
SHA512 9abc3fced662dd15bb9f35fe4e78cb0c766793d4b436923111e1760a1c5dc61c3afb89465465c07b9ed16c79274a2d347d0f1b9c5f047e404cc585f0df328d90
SSDEEP 3072:241mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5Z:Lmg1kQfATCFbzQACja
TLSH
T18EC3129A89E40DBE171208A121832EB5F7E5673FDF532EEC936E07B617D6C4A1347812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2074dcea222923e3d8fce78bb7a8bd50811bf20b713f4fa2cb0e598df8d8cbde
MD5 6530e28c1a5cefaf011731faf6f22bb9
SHA1 6bf3392632cdcc7a4e695a410f6c84e0328e3223
SHA512 c93e54e9fc6d79f36001e5e4e40c6cc9c51fdf44a067c7a830f34d3e5ac051a8caf6830b028c45638ac0881691bc0d870e7f5c1aba7f7abfcf7920cd774d469b
SSDEEP 192:sxR6RJcV/fvsEEZoDzoA8pi/g6+WNIY4SAe0iGDxIgFJ:sxR6MV/fvsE+di/5IFe0rv
TLSH
T1BF32C8166D28A93B4CCBE20DBA567F53D6FD503361D42E48EAFC960C05E76DE120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a679f16c422c5d518f0403ef069e1ea66f34decf1d97b29376bda20d0ed12a33
MD5 855687e7f1c24d535c81641cc29f6db9
SHA1 608a5aa61af210f881718c93d98209f6173a36be
SHA512 acc3507365316d656f8cbee25e2a5dc1c37f299add3410f5ce2438096c6c3b757a5c8a287bebc7f0d9fef45d3166f3d84a06ab03d8d7fe74c2ad6339bdaffbb7
SSDEEP 768:T/s0vR7pLuL7G3WgNxfPz8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaXN4yrosHG/r:T/s0vHE7G3WgNxfPzu1jaB94ph
TLSH
T181C2C97B740CCB7E4F904A9DEC1A7B9B6DA802CB96D8C98047FE941C03C76EE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 b069a3b3022600ae3c5caeb74556bee1cae2f026157cc5fd62092327c85f1bd2
MD5 4dff7b1f669c33f1287059326ef91ab2
SHA1 79dd74069fd57254699dba1fe1c4fd4f6f784bb1
SHA512 441426e14388f28510f2775ed4fcbdff2bdffb5d1559ede85b962392d769249958381983017b300c8316cd01baaca194375d620f65104ce54572301d52515311
SSDEEP 384:DNrRZyCSDnxTICKMEhIKyll7svbFKfk7:xFZJSDniqyI1l7svbF9
TLSH
T12D44840A7B747001EDE6D9725CB080771E3C716D8F22A6916DA254694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5a6a316b95a13de5fc1768c1fde94e2758ab78f329a0e2daefa07222a01431c8
MD5 f4cd034a700c5a975a3dd22265e7220d
SHA1 a3142c277fc73e406c296e10749225d952e8a0e6
SHA512 158477f0c88cd7547998c677f941aeda96efc7a9efca0a5ff65baf47d971d2e0ab2c06af65d497ebf58b1e3d2700f33a38e374fe0ef4ff037cae5abd8d7731bf
SSDEEP 768:Qrv+4UNbd23A4ithVc8O1C+AW+152MvSCainU41P:Qbsbs3AkYpx2p4U49
TLSH
T18703BE31E86AADB3CEF69AC4B64B76537FB0219384C10E94CDD96A4D028758D234BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c08ee28d4542955bfab817446c6e2db6f39ddf134278753f70d206f1c3170fc6
MD5 a9dcefa14409789bcaf065a36610b363
SHA1 7b0cafd679ff8ace38c76084de8ee49a7dc54590
SHA512 052348f52b65d3562eac74516a1f18c5da0649da0f19192a88f1694a9700686fc11d2481b39674487d149e8a95d6ac5c43a704b7d92eb9efe883279a7e14afba
SSDEEP 768:Arv+4UNbd238PthVcq+AW+152MvSCa2sX+8rir9:Absbs3upx2ptXDriR
TLSH
T1FE03BE32E869A9738DA68AC4B64B36137FB0529385C10F94CDD92B4D429B6CD231FD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36989a69-cad0-4bb2-ab51-6557e25669cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\36989a69-cad0-4bb2-ab51-6557e25669cc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

95d03e83

Path C:\Users\Admin\AppData\Local\Temp\6b5631ff\95d03e83
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6108_1305662936\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3168-124-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-108-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-99-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-96-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-111-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-132-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-148-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-149-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-157-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-164-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-163-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-156-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-155-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-154-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-147-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-146-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-143-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-145-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-142-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-141-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-133-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-73-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-130-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-129-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-128-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-127-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-125-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-126-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-131-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-115-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-114-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-113-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-100-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-86-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-107-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-112-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-97-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-91-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-90-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-84-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-83-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-81-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-85-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-72-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-71-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-63-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-74-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-49-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-50-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-47-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-43-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-27-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-15-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-14-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-13-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-12-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-10-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-8-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-6-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-4-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-3-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-2-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-1-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-0-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-60-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-48-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download

memory/3168-2619-0x00000001A0000000-0x00000001A0226000-memory.dmp

Download