0bf8f52b28291edc505a64962e6ce04387a9784fc5b18aeff53629adb1f72f56

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 953KB
Sample260703-3ct2pag16w
SHA256 0bf8f52b28291edc505a64962e6ce04387a9784fc5b18aeff53629adb1f72f56
MD5 0d6b27a00e79e8138b3d93b2c56b24d7
SHA1 e4571f7b27285ddc0e39d005a9f1109a9335820d
SHA512 185ad4ee08ce97a25fc82c43a6b4e63e36be856aba9b43d88c8159b6ef2335ce55de4ff5feb39fbf1844c3446bc1027b0602c3f42cd5203d71fe4957031beb23
SSDEEP 24576:RVP2hh0cMo02cVGjpo/jE27Ii8dwqOc5S:/28cjnNME27ZQwUS
TLSH
T12925E04BB3E460EFD6A7973089764606D37278A18761CBEF329C42211F173D49E7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
1952	wscript.exe

Loads dropped DLL 1 IoCs

pid	Process
1952	wscript.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DriverStore\\wscript.exe"	wscript.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_799439793\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_464935744\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_464935744\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_270165774\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5704_270165774\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3040	msedge.exe

Checks SCSI registry key(s) 3 TTPs 22 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275945637022295"	msedge.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{DF63A740-4FD2-46F1-B4BF-E45F5401B00F}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{33223822-E613-46DD-AD89-A62A64D21F4D}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{56BA37CD-2CF3-41A5-BDF5-DA5CC20B4911}	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3000	file.exe
3000	file.exe
1952	wscript.exe
1952	wscript.exe
1952	wscript.exe
1952	wscript.exe
2504	msedge.exe
2504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5704	msedge.exe
5704	msedge.exe
5704	msedge.exe
5704	msedge.exe
5704	msedge.exe
5704	msedge.exe
5704	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5940	explorer.exe
Token: SeCreatePagefilePrivilege	5940	explorer.exe
Token: SeShutdownPrivilege	5940	explorer.exe
Token: SeCreatePagefilePrivilege	5940	explorer.exe
Token: SeShutdownPrivilege	5940	explorer.exe
Token: SeCreatePagefilePrivilege	5940	explorer.exe
Token: SeShutdownPrivilege	5940	explorer.exe
Token: SeCreatePagefilePrivilege	5940	explorer.exe
Token: SeShutdownPrivilege	5940	explorer.exe
Token: SeCreatePagefilePrivilege	5940	explorer.exe
Token: SeShutdownPrivilege	5940	explorer.exe
Token: SeCreatePagefilePrivilege	5940	explorer.exe
Token: SeShutdownPrivilege	5940	explorer.exe
Token: SeCreatePagefilePrivilege	5940	explorer.exe
Token: SeShutdownPrivilege	5940	explorer.exe
Token: SeCreatePagefilePrivilege	5940	explorer.exe
Token: SeShutdownPrivilege	5940	explorer.exe
Token: SeCreatePagefilePrivilege	5940	explorer.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5704	msedge.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe
5940	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4232	StartMenuExperienceHost.exe
5940	explorer.exe
6036	SearchHost.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1952	3000	file.exe	88
PID 1952 wrote to memory of 5704	1952	wscript.exe	89
PID 5704 wrote to memory of 940	5704	msedge.exe	90
PID 5704 wrote to memory of 5816	5704	msedge.exe	92
PID 5704 wrote to memory of 3040	5704	msedge.exe	93
PID 5704 wrote to memory of 5816	5704	msedge.exe	92
PID 5704 wrote to memory of 5816	5704	msedge.exe	92
PID 5704 wrote to memory of 1564	5704	msedge.exe	94
PID 5704 wrote to memory of 1564	5704	msedge.exe	94
PID 5704 wrote to memory of 1808	5704	msedge.exe	95
PID 5704 wrote to memory of 1808	5704	msedge.exe	95
PID 5704 wrote to memory of 1808	5704	msedge.exe	95
PID 5704 wrote to memory of 3488	5704	msedge.exe	96
PID 5704 wrote to memory of 3488	5704	msedge.exe	96
PID 5704 wrote to memory of 3488	5704	msedge.exe	96
PID 5704 wrote to memory of 1724	5704	msedge.exe	97
PID 5704 wrote to memory of 1724	5704	msedge.exe	97
PID 5704 wrote to memory of 1724	5704	msedge.exe	97
PID 5704 wrote to memory of 5712	5704	msedge.exe	98
PID 5704 wrote to memory of 5712	5704	msedge.exe	98
PID 5704 wrote to memory of 5712	5704	msedge.exe	98
PID 5704 wrote to memory of 248	5704	msedge.exe	99
PID 5704 wrote to memory of 248	5704	msedge.exe	99
PID 5704 wrote to memory of 248	5704	msedge.exe	99
PID 5704 wrote to memory of 3028	5704	msedge.exe	100
PID 5704 wrote to memory of 3028	5704	msedge.exe	100
PID 5704 wrote to memory of 3028	5704	msedge.exe	100
PID 5704 wrote to memory of 1164	5704	msedge.exe	101
PID 5704 wrote to memory of 1164	5704	msedge.exe	101
PID 5704 wrote to memory of 3640	5704	msedge.exe	103
PID 5704 wrote to memory of 668	5704	msedge.exe	104
PID 5704 wrote to memory of 3640	5704	msedge.exe	103
PID 5704 wrote to memory of 668	5704	msedge.exe	104
PID 5704 wrote to memory of 2064	5704	msedge.exe	106
PID 5704 wrote to memory of 2624	5704	msedge.exe	109
PID 5704 wrote to memory of 2624	5704	msedge.exe	109
PID 5704 wrote to memory of 456	5704	msedge.exe	110
PID 5704 wrote to memory of 456	5704	msedge.exe	110
PID 1952 wrote to memory of 5940	1952	wscript.exe	112
PID 5704 wrote to memory of 3984	5704	msedge.exe	113
PID 5704 wrote to memory of 2096	5704	msedge.exe	114
PID 5704 wrote to memory of 2516	5704	msedge.exe	115
PID 5704 wrote to memory of 3604	5704	msedge.exe	121
PID 5704 wrote to memory of 3604	5704	msedge.exe	121
PID 5704 wrote to memory of 2656	5704	msedge.exe	125
PID 5704 wrote to memory of 2656	5704	msedge.exe	125
PID 5704 wrote to memory of 4352	5704	msedge.exe	126
PID 5704 wrote to memory of 4352	5704	msedge.exe	126
PID 5704 wrote to memory of 2504	5704	msedge.exe	127
PID 5704 wrote to memory of 3928	5704	msedge.exe	128
PID 5704 wrote to memory of 3928	5704	msedge.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Roaming\Microsoft\DriverStore\wscript.exe
  wscript.exe //B //Nologo
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Registers new Windows logon scripts automatically executed at logon.
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aae1753aab0b.pdf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7fff3c61c188,0x7fff3c61c194,0x7fff3c61c1a0
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,3630728259820820544,8249976373841803720,262144 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,11726097047393117909,7344200283761534280,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
      4⤵
      System Time Discovery
      PID:3040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,7761523759743392397,6678809176580584397,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:13
      4⤵
      PID:1564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,3063752596428297307,14157790309428753214,2097152 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,4602101076788786711,10787013719045861941,2097152 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,12973680571711579618,18017111178954566751,2097152 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,15854492099034848091,13923483252722562471,2097152 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:9
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5308,i,14902032512825270451,6857318259909014859,2097152 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:9
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5460,i,7454468634358371268,14519387181725758913,2097152 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:15
      4⤵
      PID:3028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,2250289463157656148,1698216993674750113,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
      4⤵
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,9962696342593800255,6479987744355222981,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,16785736757677805267,15193751083247695013,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
      4⤵
      PID:668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,16130426698515944672,666735310939128076,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,16130426698515944672,666735310939128076,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,9571234248742003254,14380970546735666353,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,9240446052028973488,5707101117729517096,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
      4⤵
      PID:456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,7833738829963013629,11267037490015116998,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,10730787995943101549,8828150761456711517,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,9044939078549084585,11277419624493015674,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,11939894474816127499,8259425867349732071,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
      4⤵
      PID:3604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,1981622743935487038,12002864353092892749,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,10237634604539407644,14264250291931422324,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
      4⤵
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2040,i,17281681082370694229,15602487180345578004,262144 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,9402717645573591952,11939734109873698095,524288 --field-trial-handle=2168,i,2685582312484117756,1535254647771413077,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:14
      4⤵
      PID:3928
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Enumerates connected drives
    - Checks SCSI registry key(s)
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1228

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4232

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7c10ce2209a7be22af981383a662df2bf9b2b6f3c722d92c00b7ee19cfc3c7be
MD5 a43739c5da4320f48cf0750f824476c0
SHA1 f404575158e9d52dba5ae3be89c8d5ff2ea691ff
SHA512 8a8478f2e9d207f9b7d16655a9e2d1c27f05d766aed836b8055e923fe6cffbad7355e71d4d26da1ee39591d0d37dfe88764ea06999ebfb286b1df0cec0c9582d
TLSH
T146712A98803C395FF721CBB762F1038A33B644B3596F5E120B93B5B4DDC67C980A2092
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595460.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595460.TMP
Size 3KB
SHA256 e734655ab438ab57a0dbbf68d981739b2cdc5d6d852028c5884bc55f203b4544
MD5 adfb341e26915c21db786cc257c65d84
SHA1 76843641f30ade6b516647d725aa146c78e3d716
SHA512 bf7650855caad11a4253e17ab5a52ef856b7ee4f7793ca1a793d86dcf383dd2b9f9de7e0e8919b408ac3c3aaa82ec70a6175b94b1d0bab7b7b8d4ae9132faf8f
TLSH
T1C571F8A8843D395BF721CBB722F1038A37B24477692F5E121B83B5B1CDC67D880E2096
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9cb1707eff831123ecae3630a2cd109e267256e72a19cfc0ffb73d10a19ba07f
MD5 d2b3ddf12a7b55d41613573fbf943e20
SHA1 fe438ae9fe4220220b8a6a07277a796c67172776
SHA512 3637446224f936b80331c734036126a29f6385fd11988f42dd6e1143045aec3a090470718e05bddcd7344b5912924e85f4f2df70100798e92309b6d924c848e6
TLSH
T13D51CEF3C3E8866E891185F4BA147E2BCE1D0954832C3D9AC9E4EF1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 83917d9ec68e8157c0f7cbfe6ca1d4ec0ba260dd9cbe219804c12ac83234303b
MD5 e36148b047c2e46044c1f2414acd507c
SHA1 8ec399b873eadaee6d77a56b35fea4490c4a088f
SHA512 fa73cb07db45b0fe4689acb878ddcd309f73e83a5ebd4225dfb3c304e5702b1b2be6ea5787fe772871814d26e2d7fd6e822cdae80bf722514b35c20875dcd668
SSDEEP 192:sxRRRLyM/jK1Ml8wc1/fosolowMZOp2lRzoA8p4P/g6+WNIY4kOwQAe0nGCIgtJ:sxRRrC1/fosomwyO2MG/5IsOue0z3
TLSH
T17C62D8156A24997BCCCBD20DFA557F53D6F81573A2901E44AAFC8A0C05E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 aa465b017b344496bdcccfb420a096f3de0ee92994a11f923485220bfa90cfe9
MD5 c51df8908fbbb22ce7bb31da1dda9354
SHA1 f4e57153f13907349c7ce915755177e063c9d36e
SHA512 8bb8e370bfaad6454ad88234f4f20b8b40c82459b379bda941e56608d5b4bdf923f437c02cdbc3335f4b4ed094ff0af2d8d9024e1186dc526ca680a10ab18d20
SSDEEP 192:sxRWRLyM/jK1Ml8UQXc1/foscl7wMZOp2lRzoA8peP/g6+WNIY45OwQAe0nGCIgn:sxRWrqs1/fosctwyO2Mk/5IxOue0zn
TLSH
T1AF62D8166924597B8CCBD20DF945BF93D6F81573A2901E44AAFCCB0C05E7ADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0c61e508a8ee799e38988ee523c1dd8a9c588d6d0be4a1004469005c4efefd0e
MD5 bd3d423cb4f4bb293e2ad76c367ec9be
SHA1 b4d85dd8d27d270332bceee932da319153a2f2e5
SHA512 a97fedc15db9b2344d6573765d0a21b311215b09670f4927f256d12493fe156d77a79ea8da888df4682dd5f4d65266beb2d8b9b0949b8b8ca41729fbc9af4a75
SSDEEP 192:sxRWRLyM/jK1Ml8wc1/fosclowMZOp2lRzoA8p4P/g6+WNIY4kOwQAe0nGCIgDrJ:sxRWrC1/foscmwyO2MG/5IsOue0zJ
TLSH
T16D62D8166A24597B8CDBD20DFA45BF53D6F81573A2901E44AAFC8A0C05E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 22ed364c52edf9aa0281611a9936c701562d50d2fb0188251f246b183cade8ab
MD5 89891f8af7fbd1e71bbfcf94311464fa
SHA1 bf9138fe5a6ad9022158aed49a36303d2c5fc70b
SHA512 bceeea7f12e932d3eac1e2bf9dddc6998a113af3b7c07a433d24e204654cc090afbb36710b0844056e6f1cf1bc6160b76dac2f1d6c4a509bdcadca771dbae278
SSDEEP 768:Tqi0NR7pLuL7C3WgNxfez8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdizXNG7roKTpOn:Tqi0NHE7C3WgNxfezu1jaGiz9GIv
TLSH
T19DE2EC3B680CCB7E4F804E9CEC2A7E9A6DE801CF56D8C95447EA841C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40d8592a-d9b4-4ed8-ab60-dd87c18da7f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\40d8592a-d9b4-4ed8-ab60-dd87c18da7f5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 061d2663214418f35ecdcfd57b485ad4b81b62e2d775ede9eb16a74f79be854a
MD5 70cc6fb60e03207048def1d3f0a2f27a
SHA1 2bb0460a8917a0b39eaab06fb836403ab716380e
SHA512 3f21aaee69d4364e451603d3f4b80f044beb5885aef4eef7307a406b93047c21a3dd86107a81535988733cc2b8f29a52c9cffd0e3945c591807930c690106265
SSDEEP 768:Xj+9Y34pRWthVe++AW+152MvSCaiXb9Mz:a9Y3+Wpx2p8b+z
TLSH
T1B9F2AF31A85ADD738CE687C4B74B3766AEE011A788C51E44CDD9AF0E06C764C1B4AD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 74892cd9508a4c2cb209b5406fdcfe63c98283ef5a610d5b9620e3cf59afe63f
MD5 82854a8c8c20b1f83c559782ae2e526d
SHA1 5c64f89859a879c3e01531d3f5b0b7e444706394
SHA512 ada0d2a3837a411acd1e015b24af705f837feeb070b1fb19bc2a9eb5167fedecaf8e3e397d6637abdd35e0c3ac05df396c6d385a2e6848f9bb06d30232468d4c
SSDEEP 768:Arv+4UNbd23aPthV4+AW+152MvSCa2TG+8rir9:Absbs3ppx2pmGDriR
TLSH
T17203CF32E869AD738DE686C4764B36137FB0129389C10F94CDD96B4D029B6CD230BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a93b69b6938e0bd4164cdea7464518d0290969f4fcb53d7518bdc6badcca04aa
MD5 22af064f153df24919e4afcfde3cca9c
SHA1 502d4c680424fd39e6a7850a690b7641ebfb256d
SHA512 1610546e2868c1a9cda096fae1b52810b929e321fbc51f152407a45a637e650640d56b625ef8e5ff9c5a90086058b26e1960f63671e8c6733dfff650c842d74d
SSDEEP 768:Krv+4UNbdW3Z4WthVeZ+AW+152MvSCaiXa:KbsbE3Cpx2p8a
TLSH
T13303AE31E869DD778DEA82C4B64B36537EB0219389C50E54CDD9AB4D028B18D2B4FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d5c38c3c47eae986a27bd4ad4f7abc48df884aa67d839c7d019c9b50c672229a
MD5 6d9180107cacd650d253c493feb01283
SHA1 42f77e75fbbd3f10c613557fa66464d8f0d1d5dd
SHA512 8318745c4c15fe625c34c835bded0386838e2e754a5eae491fefdacebc2f1c83e1e5f93b6ea5973cfbaf54b34bb128948d5e46626b82bbb166c2f15eec974963
SSDEEP 768:7F1j+9f3rwgZpRL6hVeB+AW+152MvSCaiXb9Mz:a9f35dpx2p8b+z
TLSH
T1FB03AE36D856CE7B8DE387C4B74A365AEEE011A789C81DC4DDC8AE4D01C729D074BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 28883c7faa6cdaf7889c41a04bd41d54e22d8a9e9fb41d4048b234a56b385c3a
MD5 2fe521d41692e34bdba9c94656e5e70f
SHA1 5e57b6cd19505081ae4ef37856aa0c957a7a98ee
SHA512 5024cca71e20436563c832795dcd09f0e9b79f909495ccca2a36535bd62c0cc9ce553be1e78c14c148e8942cfd34edf902931f7f9657b9d0d09278eff88a1439
SSDEEP 768:Vj+9Y3dpRWthVe++AW+152MvSCaiXb9Mz:g9Y3bWpx2p8b+z
TLSH
T1EEF2AF31E85ADD738CE687C4B74B37A6AEE011A784C51E44CDD9AF0E06C764C1B4AD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

aae1753aab0b.pdf

Path C:\Users\Admin\AppData\Local\Temp\aae1753aab0b.pdf
Size 66KB
SHA256 55f2cb10c9edad56ed856f51a2406945f3438d791567fb62c606e2e9696cfaa2
MD5 7f74026903871a6772cde53c44732bd3
SHA1 9e2649804e06e73d8786bf9d44fd692ebc314540
SHA512 123a7a89d61cdeecd6cdc3e4d740b8787fcda241f7da3d1e440ef021821d65dbad3638c76bc57baf9cba96eb2df9a21ddb6638c35411dd1012ef655a1628bc0a
SSDEEP 1536:etjYq+zsnfngED07SpJy4d+imlpaLROIuNRlVZI:MjYRzsfc7Sy4dhROBDS
TLSH
T12D63F1641AD33D420239004296442E57CCD798E7390FAD06F65D8B7B2F2AFE0AC766E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5704_2033963286\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppxState.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\DriverStore\AppxState.dat
Size 661KB
SHA256 26223398626d3a92612344edcb26c1067914a179665596005cb704d38fb0f71e
MD5 9859c6ce1d8375c60764f287df66be6e
SHA1 3a18cd0a9e2e926260a6606f02edc2f7ee25e7e1
SHA512 ee26d3a6055e60a5777f0d9b0ba9e14bee8a78fb9af69a6c1872a3547d5283decea55878b542dbaa4c2a9926f66899d4c5d0aad76ce827775c22f245886c6f94
SSDEEP 12288:C6IatZy0ge7/HgjYKcmsGjphOHX6k5hPljE8jKRzUZIin80pSbR4DLLpAVx6ciKS:CMo02cVGjpo/jE27Ii8dwqOc5S
TLSH
T1FCE4028FF3D0F4CF1B8A6B416EB8897643717CE6CAD3CB9A389C4620479839952E3545
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VERSION.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\DriverStore\VERSION.dll
Size 145KB
SHA256 00bd2beaa7ad06c5cb690fe096319321bf64814d81e0d9c68ee1acee86588555
MD5 1d2c65a1d859d74c0cc9bac4745a1c6d
SHA1 5f5e4d1cbe61799f5bf6c9f0a008fb90f9501358
SHA512 5d48f07470542b9555dd1fa03d2da82e0bc8bed7d73028944c66155a64c0903362546c4adc62a848a14cc758fa9ebee8f90819a72e75d52f6bfa9541158b3309
SSDEEP 3072:92gQ+Gxnir1xU8I2+DFZFgnDeQJ1ckVPxIiThyGP:92hhirzUhtHFgni
TLSH
T190E36C5BB3A501FBE5B79234C9671A46E772781107609BEF03A442352F273D49E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wscript.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\DriverStore\wscript.exe
Size 196KB
SHA256 ae770c7544f0ab1c742a55a3c963b1c33e62cf899e4014fef559822f32464cee
MD5 6b4cbd10cd6eb2f9f2d52b1c81acf57e
SHA1 967d1bc420bbcf9b372209a89cf5323810e852b7
SHA512 7e7d202ddaa17c057d7685b84a2ae46c765e83648b99930d04a30dd294f3a0225e91f29640106f85300798b8c8855f1a9649a22350f46c112e935522a926dea7
SSDEEP 3072:CnP/WcjGq/l4XsfBKBjM6NyYsDhV0URWcCGpcT+WUZxtt:CnXXjGqNMBo6NyYsDhVztNcT+nZh
TLSH
T19214F65A33E9A0E1E269523889274255EB727C342F2266DF13D4A3BD5F336D8BD34B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1952-18-0x000001ED8C690000-0x000001ED8C8F1000-memory.dmp

Download

memory/1952-299-0x000001ED8C690000-0x000001ED8C8F1000-memory.dmp

Download

memory/1952-82-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp

Download

memory/1952-20-0x000001ED8C690000-0x000001ED8C8F1000-memory.dmp

Download

memory/1952-12-0x000001ED8C690000-0x000001ED8C8F1000-memory.dmp

Download

memory/1952-287-0x000001ED8C690000-0x000001ED8C8F1000-memory.dmp

Download

memory/1952-214-0x000001ED8C690000-0x000001ED8C8F1000-memory.dmp

Download

memory/1952-15-0x000001ED8C690000-0x000001ED8C8F1000-memory.dmp

Download

memory/1952-11-0x000001ED8C690000-0x000001ED8C8F1000-memory.dmp

Download

memory/1952-16-0x000001ED8C690000-0x000001ED8C8F1000-memory.dmp

Download

memory/1952-21-0x000001ED8C690000-0x000001ED8C8F1000-memory.dmp

Download

memory/1952-17-0x000001ED8C690000-0x000001ED8C8F1000-memory.dmp

Download

memory/1952-13-0x000001ED8C690000-0x000001ED8C8F1000-memory.dmp

Download

memory/1952-14-0x000001ED8C690000-0x000001ED8C8F1000-memory.dmp

Download

memory/1952-19-0x000001ED8C690000-0x000001ED8C8F1000-memory.dmp

Download

memory/5940-471-0x0000000008CD0000-0x0000000008F2F000-memory.dmp

Download

memory/6036-323-0x0000028381C70000-0x0000028381C90000-memory.dmp

Download

memory/6036-341-0x00000283941F0000-0x0000028394210000-memory.dmp

Download

memory/6036-294-0x00000283801E0000-0x00000283802E0000-memory.dmp

Download

memory/6036-308-0x0000028381A10000-0x0000028381A30000-memory.dmp

Download

memory/6036-310-0x0000028381E70000-0x0000028381F70000-memory.dmp

Download