ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d

Analysis

max time kernel
97s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 950KB
Sample260703-tgadeahs9p
SHA256 ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d
MD5 a9c499afa0278279acd80597cbfc1e47
SHA1 5f7f11caf5992f370ed9657ff898b96fa4fe17ba
SHA512 4df0562be441485d24b280e62a04361d8a46daab1b16ae577b81c9b30b6155a9d899b91d4bdfcada8921f4a3dccefdde0e40731e7d01298a4ddcb345a08365f3
SSDEEP 24576:K+1mq2hh0vPWqKHeM5eJYdYsGN2U5JIxpZ5S:d328HjK+mMsG0Uc7rS
TLSH
T1F725F11B729911FAE0234174C9B75A05FBB2B4760774479F339C02A56F1B381AE3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
3264	cscript.exe

Loads dropped DLL 1 IoCs

pid	Process
3264	cscript.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DriverStore\\cscript.exe"	cscript.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping264_1669590201\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5364	msedge.exe
3696	chrome.exe

Checks SCSI registry key(s) 3 TTPs 22 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275680825755242"	msedge.exe

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{ACA69D25-E70F-49A9-BB92-E1FBF49780D4}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{6B532720-96A5-4468-80AC-3EDBC98531FB}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{05921632-917F-49B3-A24D-D370E712FED9}	cscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1868	file.exe
1868	file.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe
3264	cscript.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1988	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeCreatePagefilePrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeCreatePagefilePrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeCreatePagefilePrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeCreatePagefilePrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeCreatePagefilePrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeCreatePagefilePrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeCreatePagefilePrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeCreatePagefilePrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeCreatePagefilePrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeCreatePagefilePrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeCreatePagefilePrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeCreatePagefilePrivilege	1988	explorer.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
264	msedge.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1928	StartMenuExperienceHost.exe
1988	explorer.exe
3532	SearchHost.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 3264	1868	file.exe	88
PID 3264 wrote to memory of 264	3264	cscript.exe	90
PID 264 wrote to memory of 4196	264	msedge.exe	91
PID 264 wrote to memory of 672	264	msedge.exe	92
PID 264 wrote to memory of 5364	264	msedge.exe	94
PID 264 wrote to memory of 672	264	msedge.exe	92
PID 264 wrote to memory of 672	264	msedge.exe	92
PID 264 wrote to memory of 5052	264	msedge.exe	95
PID 264 wrote to memory of 5052	264	msedge.exe	95
PID 264 wrote to memory of 6132	264	msedge.exe	96
PID 264 wrote to memory of 6132	264	msedge.exe	96
PID 264 wrote to memory of 6132	264	msedge.exe	96
PID 264 wrote to memory of 4060	264	msedge.exe	97
PID 264 wrote to memory of 4060	264	msedge.exe	97
PID 264 wrote to memory of 4060	264	msedge.exe	97
PID 264 wrote to memory of 3452	264	msedge.exe	98
PID 264 wrote to memory of 2752	264	msedge.exe	99
PID 264 wrote to memory of 3452	264	msedge.exe	98
PID 264 wrote to memory of 3452	264	msedge.exe	98
PID 264 wrote to memory of 2752	264	msedge.exe	99
PID 264 wrote to memory of 2752	264	msedge.exe	99
PID 264 wrote to memory of 4636	264	msedge.exe	100
PID 264 wrote to memory of 4636	264	msedge.exe	100
PID 264 wrote to memory of 4636	264	msedge.exe	100
PID 264 wrote to memory of 4088	264	msedge.exe	101
PID 264 wrote to memory of 4088	264	msedge.exe	101
PID 264 wrote to memory of 4088	264	msedge.exe	101
PID 264 wrote to memory of 3892	264	msedge.exe	102
PID 264 wrote to memory of 3892	264	msedge.exe	102
PID 264 wrote to memory of 4404	264	msedge.exe	105
PID 264 wrote to memory of 5480	264	msedge.exe	104
PID 264 wrote to memory of 4404	264	msedge.exe	105
PID 264 wrote to memory of 5480	264	msedge.exe	104
PID 264 wrote to memory of 5996	264	msedge.exe	107
PID 264 wrote to memory of 2068	264	msedge.exe	109
PID 264 wrote to memory of 2068	264	msedge.exe	109
PID 264 wrote to memory of 4232	264	msedge.exe	111
PID 264 wrote to memory of 4232	264	msedge.exe	111
PID 3264 wrote to memory of 1988	3264	cscript.exe	113
PID 264 wrote to memory of 6004	264	msedge.exe	115
PID 264 wrote to memory of 4460	264	msedge.exe	116
PID 264 wrote to memory of 1140	264	msedge.exe	117
PID 264 wrote to memory of 6884	264	msedge.exe	122
PID 264 wrote to memory of 6884	264	msedge.exe	122
PID 264 wrote to memory of 4548	264	msedge.exe	126
PID 264 wrote to memory of 4548	264	msedge.exe	126
PID 3264 wrote to memory of 6152	3264	cscript.exe	127
PID 6152 wrote to memory of 6180	6152	chrome.exe	128
PID 6152 wrote to memory of 3696	6152	chrome.exe	129
PID 6152 wrote to memory of 6532	6152	chrome.exe	130
PID 6152 wrote to memory of 6532	6152	chrome.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Users\Admin\AppData\Roaming\Microsoft\DriverStore\cscript.exe
  cscript.exe //B //Nologo
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Registers new Windows logon scripts automatically executed at logon.
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f044833f4a12.pdf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc54b9c188,0x7ffc54b9c194,0x7ffc54b9c1a0
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,4579762403770928441,12978966685970556943,262144 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:2
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,17809064441042663649,18165466549691062576,524288 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:11
      4⤵
      System Time Discovery
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,7408787662304708685,6896660403384575382,524288 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:13
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,5427369260982017031,6243637906190659471,2097152 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,11270449806456700138,4279812020842282057,2097152 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,8826566952409780072,478443376828865764,2097152 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,17235075979006964433,2884212314701682450,2097152 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:9
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3836,i,14619713198093751530,333938755637969777,2097152 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:9
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5196,i,72013623187281649,744151566274611020,2097152 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:15
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,16837535710552388461,15492691510116080308,524288 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,1621449736348343432,8137493213091749474,524288 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,5940461474468233389,6400015286265385663,524288 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,4393747343181105563,4543698350152495668,524288 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,4393747343181105563,4543698350152495668,524288 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,3936855553607191142,4876723469707083607,524288 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:2068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,3336853162955582149,5405875877894001623,524288 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,4046390189671234808,14833290126133395780,524288 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,15892930968950734145,9104917327198407164,524288 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,6270966295102885331,2633830084928888535,524288 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,10837289792003514125,13690792096615793885,524288 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
      4⤵
      PID:6884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,14994162224240612284,3497799312614544474,524288 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,1577708620326292978,4044530974252162263,524288 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2308,i,11882254327424162765,4353890138132577910,262144 --field-trial-handle=2912,i,9109651709389524395,10097779260520579507,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:10
      4⤵
      PID:6168
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Enumerates connected drives
    - Checks SCSI registry key(s)
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-gpu --disable-gpu-compositing --disable-gpu-sandbox --disable-software-rasterizer --in-process-gpu --disable-accelerated-2d-canvas --disable-accelerated-video-decode --disable-features=VizDisplayCompositor --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --disable-background-timer-throttling --renderer-process-limit=4 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-first-run --no-default-browser-check --disable-features=RendererCodeIntegrity
    3⤵
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:6152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffc547cc728,0x7ffc547cc734,0x7ffc547cc740
      4⤵
      PID:6180
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-gl=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1416,i,9129546849461527154,11838455186525604147,524288 --field-trial-handle=2444,i,14787269931907619894,10419631732173770570,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:11
      4⤵
      System Time Discovery
      PID:3696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --use-gl=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2012,i,8276980344442213582,10866265393967865921,524288 --field-trial-handle=2444,i,14787269931907619894,10419631732173770570,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
      4⤵
      PID:6532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-accelerated-video-decode --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3064,i,14383915492696047777,8062892959103588213,2097152 --field-trial-handle=2444,i,14787269931907619894,10419631732173770570,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:1
      4⤵
      PID:2640
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-accelerated-video-decode --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3068,i,4148890097355113240,5270347470675575893,2097152 --field-trial-handle=2444,i,14787269931907619894,10419631732173770570,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
      4⤵
      PID:6620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --use-gl=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5204,i,6140320239091931044,15895492570949181588,524288 --field-trial-handle=2444,i,14787269931907619894,10419631732173770570,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
      4⤵
      PID:6772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-accelerated-video-decode --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5396,i,9821114721445632519,3352647758657054651,2097152 --field-trial-handle=2444,i,14787269931907619894,10419631732173770570,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
      4⤵
      PID:6768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --use-gl=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5408,i,6509132467707002677,17353236796592156263,524288 --field-trial-handle=2444,i,14787269931907619894,10419631732173770570,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:4320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --use-gl=disabled --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=5748,i,133976597204683283,10758893230395179857,524288 --field-trial-handle=2444,i,14787269931907619894,10419631732173770570,262144 --disable-features=RendererCodeIntegrity --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5408

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1928

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 69d3dc50c332bd68072742684d09c4bd3dec5efbe841c0c40e422cffe5115aa2
MD5 cd21cd331a77b95d21ce1b4d778b76db
SHA1 14df1b3c8b1c2320273632971b2eba4f1fd38fa9
SHA512 1e965720cf321775360819b1fb5d7655ac13c33454a0e72e529e45e55cf689576e362e7aef7b61f2db5cb6ecec1782e31bd08626de6f5e35d5a8614b533be4be
TLSH
T193415BF7C3D8997D890156F8AB152F2ACE6A0925531C3C26C8D4AE1F53E69B6D20054E
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 523B
SHA256 20b47167f494a995dec0ddbafa13caa7a2d5ae3be0d499266cfe06e6094a7b70
MD5 71e4da24fd68edca6c6c2fa4bf5f0e86
SHA1 7ec1e2a7a22677f81128984304aa096f2f036d66
SHA512 29c84a38061589dece88ffc56b2ce673f4f0ecd3e804644ffec1bf80b97121707e9511b0136f53a49780954d12999f408134409976d0d82f61507a2f091cd56b
TLSH
T168F059A7AB7D746B10B845FA0D45B8096D76F430025058F6CE9A436DB0DA5E30F12013
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 e1eab6048485ef33fab1712287fe0ef26b3011b41087d335e3dcdae3d08876bc
MD5 881d2e17680e0636efc5a8861c51dc45
SHA1 0ce920c2aadd161e9a3c5d3e22857d4828d4ef60
SHA512 47182dd789f42f52bf2380d7e6fe5745822aacb8484391b4915472b4ffe6a6f74153ab9e5b816423630e01ebf82c6fa171062c41e43b6115d6b4ee429a4fb6a3
SSDEEP 192:1RkdSlxWv722uIAPRp25i9gHsb+WNnvN0KCfPyIsnAUgR:1RkdSPia9XDywF0h7R
TLSH
T1A122A76EA914653B5CDBC32EF9667753E3F5102131E02E44E6FC8A2C16E76CC622342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 8cc8a4b6eead42a910e352bf89cedf9754f4c893c07e57db54289df2fe998ba7
MD5 8961970f5c0dbd7fdba1df98205d01a7
SHA1 f98edc89bd910a66aaa833b676afa247f9890f66
SHA512 6381d1aa4ca7e40f41e09e6ffe899634a0bababfaf5fcb80c58fd30b98edf9ead93880ae12b2b7e3b2eaf8107602873dd0d87f36ea9fb02199148d24a30773b0
SSDEEP 192:eO94K67b7KxkXqK4I40pUZNCgVLHrKHfFKslE6ZXXzKD/QX+ErUkKN9yUS1vG62X:T9jYb7KxkXqKf/pUZNCgVLH2HfgslNXy
TLSH
T1AE32E927948D9A3F4FD8D50DDC166F8B6DB4029273780D24A6FB9C0803A57CE215A6FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 774b770dc1f45e49572c0f2c9e4752951215ca0cc98ea1cfab34b47bf436f873
MD5 35bf388405b3e4fadc08c0b7c942a953
SHA1 3b4de9f44433058e958ef1abd4e4e39668ac958b
SHA512 d2eea7234851e0cb443d2ee1b98d02711f25e114bc44bc4b86c1eaf0ef53319335f564f2a252bf80ffb3eb7804852c3c5ba3a70fc80564d43043b22fe3b0b070
SSDEEP 96:8C6Rd+6YI1dEYQHofAK8WyadykSl8h4otok5vOtD8B6eGyvS6XbxwHLeOf4bky9K:8C61YIcYkVK8WyPoiUDwQeULx4efbkyQ
TLSH
T168C1F87668AD5CB30DF6D98676033A43CEB4A16BAA509F04DEDA1F0C01EB1FD1346626
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 2468353efced17cb20b6e8e207c332f2694fd3456fea10c2c00c6cdce3ab2c08
MD5 47ef7127977a7bcbc2dc425984c9e045
SHA1 6b43666730f20f6e807bb6a99013d8fc7ea5f9fd
SHA512 d0205786d9e8517162ad9046b64b16711ff16c0eaa10d77337ac2a14cf9970b40c73068bd3c5f5ca762f2ccff0f78064e3d8b18caf6c15c3c07d7135cbebf4bd
SSDEEP 96:eC6v1d+6YI1dEYQHofAK8WyoCdPRDotok5vgD8B6XGyvSO8R9PEtvZF9v4a:eCC1YIcYkVK8Wyo8DUDuQv88R9sthFh
TLSH
T163A1F735697C4DF358B6C58976423B43CF64B0ABAA71AF88DADD5A0C11BB0FD1302627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27eeefdbc28c4562b0f7961dbf8ecc36dc6cdfdb8dba90b92fab4f8d38495733
MD5 02240668b330773d82eb39ca82064ff3
SHA1 da6a7c95e21b04cb7aa5296fa464996f592a9476
SHA512 850ad2cbde9cda49998ffee162ecf4a7e854604619f29434682d460d4b33049219c253cb3208a75d43cda1a23a05ad280b0f98228e3cc9146d1a22b246e53b30
TLSH
T1E2D08011379CFC09C945303658515751F5155861145F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bea28d9638dac59990bdc6b9fece9f477f8d28c508c1a253fd1565bbc9fc4ae3
MD5 f10d65bdc736c03466ef52fb3e973cc6
SHA1 1553d68481be544f8fcd8f4f31978854061662fb
SHA512 1789433df7c4cb6b8c6af88635e9335389bfe36da7d8457f3b16e6d774ad9e050c045de056bbf16dcb7c5f7f882bdde6345ed9e7f12c4d6295e169346b1bbbf7
TLSH
T186D08015378CFC09C945303258515751F5255861645F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

03054b47-b4dd-4351-b14c-cedd26a0a16e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\03054b47-b4dd-4351-b14c-cedd26a0a16e.tmp
Size 14KB
SHA256 ad41dd3d379a08597c1bb06e227fd78295c5431d4f5332cfbffa07a7479c730f
MD5 c0d8ff1e9604b3cd5359844787ac302e
SHA1 63d0e0af967e6f45ed0ae3913c2b661828e1d6b8
SHA512 330d83a1bf0aba8effad4c4065007db5e565605facadd8bc1dc14b04f2635d8666f5de5a3ba4b6b3a51ad8ee06b44dffac0984ae70f1cf3e6a089a4a87859d2a
SSDEEP 192:sxR9RlyM/jK1Ml8wcy/f5sQnYVIZKprozoA8p4h/g6+WNIYTYOwrVSGSIgtJ:sxR9FCy/f5sQu2Kp1Y/5INO+43
TLSH
T12962D9156A28593BCCCBD20DFA567F53D6F91573E2901E44AAFC8A0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 25ee9694149243d91994b43a6c52aaf0c46e884552799570d4602abedea9ad98
MD5 cc1059bb05842e63885b5bea758757ea
SHA1 ed1e321322cf3e7e5287058bf287de8ade6676ba
SHA512 9fe68789fb0e9a587c2283f7a5f7474fd2dbd71ac4a574ab12d84a6464b5295cc3ce1518df12b20b4343b2af0a865b20f0c4bc717d1937d06e829c6caa230e64
TLSH
T12771C86533514BD3EB1AD67617EDE3AB7E70C0A387CB7F1911BCA07888067646015C5A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bbe4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bbe4.TMP
Size 3KB
SHA256 081ab71c2aa316bdb5f502d9008f28997b5cfa793ef8bf5f2b9300701b5f90fd
MD5 a8fd9e699f2cd953fa4043883e4fc212
SHA1 e37040d9318661037bf790d610abf3267290dbb8
SHA512 46c1dd63ce17cca39688ac9c19ed2cea011903269e5d43de9a7a322023d1be7d744b9d1391563679ea481969077dd9ab5ec8442662e3db039b0bcf3796c5084a
TLSH
T16D61C46533520BD3EB19D5B617EDE3ABBE70C4A387CB7F1811BCA07888067546012C1A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7785aac523efa0e6d166fc7a43c1b6982b399de441ff6e4129c23ecaa88427c1
MD5 95af58692b6cffbcb311885f50689de0
SHA1 70d23288c442ccb592e2ae8494280927b74f524f
SHA512 0d217d2596614467bcb545260ca5d3142ee55aa743db413a95d4db4372f9bbb13ccdf79defc224021b964ae7756e16277cfabbf20f47853bb125231f261b2bc2
TLSH
T16751CFF7C3E4856EC90145F4BB187E2BCE1D0915832C3D5A89E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 89f1426b3a356c958eb6428dbb7ff66064b32d84a5e178fa6e806ef33f58ecb0
MD5 73ec0a8ca7e60c613eff7932ee1994f6
SHA1 bbd3d01d10e426af0f7908a4394ac2acef4fd1d9
SHA512 18f08258e2e1860c98ef0f4feaf424c9b1bf265e8cc1b01310519ad9745be8687745813db1b0b11d7b78287aa5e1b2cba01e8f8267dd2e4b0e85d80229c487ca
SSDEEP 192:sxR+RlyM/jK1Ml8UQXcy/f5sHnYSIZKprozoA8peh/g6+WNIYT+OwrVSGSIgDAJ:sxR+Fqsy/f5sH92Kp1u/5INO+4Y
TLSH
T1AE62DA166A28593BCCDBD20DFA867F53D6F91573E2501E44AAFC8A0C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 65753a48e1a0d012ed986542584cfcbdcb02e8c394f7453604649c736dbcb92a
MD5 01a5bfcd508f5dc1a68a56a9a335f20c
SHA1 0f8591a929e4705338de9ae587ca9f480b77c017
SHA512 011c2373b04656e86a3cc4c6f25271ada5b630e0ad9050a2a64cd6ab83f11831889e1e0fc5e5c35d86d26bd71f1c6ea9026e8bc6734f60a1b6c43e17e7d45d1f
SSDEEP 192:sxR+RlyM/jK1Ml8wcy/f5sHnYVIZKprozoA8p4h/g6+WNIYTYOwrVSGSIgDOJ:sxR+FCy/f5sHu2Kp1Y/5INO+4+
TLSH
T1D162C9166A28593BCCDBD20DFA467F53D6F91573E2501E44AAFC8A0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4eaa123978275de3c0900a974d75cd3b58bc5cf5a62e64ee8419c91f4e1050fa
MD5 8ea86de2e33bcb1905239fab307a17e1
SHA1 ef82ff4cd5a1d23a46feb644718d47e86705ff53
SHA512 091f64bc69ab601587d218192d69831e6c73d89fee2170c16afd4f4d91d88bc796e31c9a53c99e5c3b7dc5192b0fb25baeabcd162c6e6e100c1a59e6a7804af3
SSDEEP 768:RGqOBJ7pLuL7CrWgTvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPrDzFY4roN8CZ:RGqOBfE7CrWgTvfiXu1ja4rDRYDNR
TLSH
T1DEE2FC7F680CCB7E4F804A9CEC29BD9E6DE801CB56988D9447EA450C03C67FB55164EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e3e9d19f901b5a8de73b8f280ff49d7d8cbda242e933b2d6e4911c2e7f3f144a
MD5 543499ac5b3b2e672e72d5be5cb4a599
SHA1 da888d73171a7ad8f11554c289177db46c203364
SHA512 1738872e73d510c6981282c43275cbf4eab22313f2fa3e2081646c6b5bfda31f2b294a17c77588d317094e721993f30557e431571d660748683e2ebc45fd926b
SSDEEP 96:KnWNC2cUUeWErFMWeKUrMYeAuWToG/BKxuq4YoSWAvhM6SKUXMUSA6yn8SVCbvl/:olZfVCbvlfj2LQ/3dGgJ8NVIbTMH+zC2
TLSH
T1AA91E510737B3A80383D354590B6882F568370677425652BBFB8A1A59F2BE01EFFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4279.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4279.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 618e1062b67be21f59cd18020c7dfa97686670aa705deda948cff980eda97988
MD5 04159b660552882ee740ba3522e8ceae
SHA1 a374dd80dec9d5fe70bc8fd6ee5c82468b446754
SHA512 bb391919375268b74cee4af5128eda1bb508e09775b704d0990206f3aad06060e8c431c4e3fb6aae79418b3f82db45037e5b71d46527be9725c4cff9b2a7c695
SSDEEP 768:qj+9T3U6cJ+XodOiIyN8Y1M1fmBnZ6b9Mk:J9T3UYXodI11Vb+k
TLSH
T158F2C031DC62CD638CE79289F6A736866EF011A7D9C41E88E5EC9B0E04837EE5707C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f23cf5c65b359960f7c17466d2006bcc19d5b46be5c6180c037fd935e495e986
MD5 d0c007c4cdec9ace2a390bde4ef2fa85
SHA1 3cb80d085f5b243c22089b2f32ebc91ff2df6ce2
SHA512 6d55d0aaf4acf76bc386506b90add1be18d3219b51ac4187c51666269e7545967b9e4b6e16f2d4f72b8dadc9bc4b0fd70203517a6ec1d94837489a443c9caa6f
SSDEEP 768:Yrv+4UNbdj3D6vJUXodOiIyN8Y1M1fmBnlbv0B:Ybsbl3D/XodI11s8
TLSH
T10503CF32E864D9778CF38288B54762477EF451938BC50B94DADD6B0E8147AEE230BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d94551304750cf941a7e2a73bd1ecebd7d34c624a301f9b109dffb14d3838043
MD5 56e13056602dc54d3f469f3c1fd80a28
SHA1 a2d884009bd1e293a3d348e2b3ddb937c7a76c00
SHA512 dce6f81a20e2626f4b297f3d98dc11ed1595dbdc1047565bd10d9a884bfe743d80cfcf633b0acb63e0513c4ac6641b1ae9fb26440545684aa5974b5a2afc1ea3
SSDEEP 768:xrv+4UNbdx3m6WJrXodOiIyN8Y1M1fmBnZ6o9c:xbsb33mzXodI11Vic
TLSH
T14703BE31E864D9738CF79188F59736877EF420A399C50B84EAE99B0E00476EE230BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6c0f801dbd4330e07728be2865a407354ef39d9f4779ec9d22ef259929999acb
MD5 2761d4a13fe0c752b326f34e47c57c9a
SHA1 a0ddbf0c0765a71a4426406532a62931e482a4f2
SHA512 fbcf0a44315151e7c40fa2180205db226cef8d92c852f2999db9e5f86e72854d48443422f6dc5fc8fd9079e1347fd7ed9a28550c5a3b025765da126321044afe
SSDEEP 768:6j+9T3h6cJ+XodOiIyN8Y1M1fmBnZ6b9Mk:59T3hYXodI11Vb+k
TLSH
T149F2C031EC62CD638CE79289F6A736856EF021A7D9C41E48E6EC9B0E04837EE5707C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 550bb38ee221b30a6779759452c7e3179d2ca26d36c6204828511321d8e2bf0b
MD5 b429c719b4639b0572adfbf600b6b080
SHA1 5d5aedb3f29c5c9a7a7f18778109937f08f98b67
SHA512 900fd7c4b6ace9374f3a5ba55df32523a40bc14537e4a1b8ddaa770941277c96738583c941ca26fbace8b4eaeece14adbfeb1f36edbe3b3cadae038f9ac9c4a2
SSDEEP 768:tF1j+9I3xwgb6c0uXodOiIyN8Y1M1fmBnZ6b9Mk:k9I3LDXodI11Vb+k
TLSH
T135039E36DC51CE6B9DE38789F756368AAEE011A7C9C85DC4EAD89E4D00832EE070BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

f044833f4a12.pdf

Path C:\Users\Admin\AppData\Local\Temp\f044833f4a12.pdf
Size 66KB
SHA256 55f2cb10c9edad56ed856f51a2406945f3438d791567fb62c606e2e9696cfaa2
MD5 7f74026903871a6772cde53c44732bd3
SHA1 9e2649804e06e73d8786bf9d44fd692ebc314540
SHA512 123a7a89d61cdeecd6cdc3e4d740b8787fcda241f7da3d1e440ef021821d65dbad3638c76bc57baf9cba96eb2df9a21ddb6638c35411dd1012ef655a1628bc0a
SSDEEP 1536:etjYq+zsnfngED07SpJy4d+imlpaLROIuNRlVZI:MjYRzsfc7Sy4dhROBDS
TLSH
T12D63F1641AD33D420239004296442E57CCD798E7390FAD06F65D8B7B2F2AFE0AC766E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir264_1664567761\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppxState.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\DriverStore\AppxState.dat
Size 659KB
SHA256 e7acc05630d855b8ea57fd23be2e46c73d48f8de5006a28ec71ab302f1da1fdf
MD5 6058e20462440874bdc591bd0ffa08f3
SHA1 7127e5154e698747d93fd342e0ebf6dd565ce7dc
SHA512 511a3efb35cc6de9598d56bdf54b6f96e3248f1e355c44c950e78ed6e56cdf1b35b10836437be2612b9034b179bebf5d7250fd802e222181ce7f856ec8a0544c
SSDEEP 12288:1CuggwlMMHpqKHENMJ/8dik17W1T7VvTYkF9kpHmiidwqURBRDJIxpZiKiN:NPWqKHeM5eJYdYsGN2U5JIxpZ5S
TLSH
T1D1E4123D000C956965130481DEFABE45BCD9D2BF2A7D0116795E2AE5EF4F803BF0E9A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VERSION.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\DriverStore\VERSION.dll
Size 145KB
SHA256 00bd2beaa7ad06c5cb690fe096319321bf64814d81e0d9c68ee1acee86588555
MD5 1d2c65a1d859d74c0cc9bac4745a1c6d
SHA1 5f5e4d1cbe61799f5bf6c9f0a008fb90f9501358
SHA512 5d48f07470542b9555dd1fa03d2da82e0bc8bed7d73028944c66155a64c0903362546c4adc62a848a14cc758fa9ebee8f90819a72e75d52f6bfa9541158b3309
SSDEEP 3072:92gQ+Gxnir1xU8I2+DFZFgnDeQJ1ckVPxIiThyGP:92hhirzUhtHFgni
TLSH
T190E36C5BB3A501FBE5B79234C9671A46E772781107609BEF03A442352F273D49E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cscript.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\DriverStore\cscript.exe
Size 184KB
SHA256 7b3973fc3d78340af8dceec0cf8b626046eb4e36dcacca5f8164b39945f1c9df
MD5 f9d16f6a7b44d0e272f2b072eef2c40a
SHA1 bc74ae3c8df19d88c7a23b4d0b7d3526d6046362
SHA512 9ad38cbea2c68514ba824dc7f375189a05cf6a839212223ca098c9f54ef144c4b92e5c2bb072d43fd751ae7f9fb1fed6d323fbad60ce2dce397b8eb8d992754c
SSDEEP 3072:eeQ94lCMhOND74L0Xkt92AVWeFNCCs8cCGXfeV6IZxtt:eL4oMKD74L0XyVWeFNCCoTfUfZh
TLSH
T18304074A33E490D5E17A623C89564685EB7278352B2267DF13D482BE5F33BD87C38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3264-12-0x0000020848E90000-0x00000208490F1000-memory.dmp

Download

memory/3264-17-0x0000020848E90000-0x00000208490F1000-memory.dmp

Download

memory/3264-13-0x0000020848E90000-0x00000208490F1000-memory.dmp

Download

memory/3264-427-0x0000020848E90000-0x00000208490F1000-memory.dmp

Download

memory/3264-14-0x0000020848E90000-0x00000208490F1000-memory.dmp

Download

memory/3264-19-0x0000020848E90000-0x00000208490F1000-memory.dmp

Download

memory/3264-21-0x0000020848E90000-0x00000208490F1000-memory.dmp

Download

memory/3264-216-0x0000020848E90000-0x00000208490F1000-memory.dmp

Download

memory/3264-91-0x00007FFC68220000-0x00007FFC68483000-memory.dmp

Download

memory/3264-11-0x0000020848E90000-0x00000208490F1000-memory.dmp

Download

memory/3264-20-0x0000020848E90000-0x00000208490F1000-memory.dmp

Download

memory/3264-15-0x0000020848E90000-0x00000208490F1000-memory.dmp

Download

memory/3264-16-0x0000020848E90000-0x00000208490F1000-memory.dmp

Download

memory/3264-18-0x0000020848E90000-0x00000208490F1000-memory.dmp

Download

memory/3532-301-0x00000196838C0000-0x00000196838E0000-memory.dmp

Download

memory/3532-335-0x0000019694660000-0x0000019694680000-memory.dmp

Download

memory/3532-321-0x0000019683B20000-0x0000019683B40000-memory.dmp

Download

memory/3532-302-0x0000019693D20000-0x0000019693E20000-memory.dmp

Download

memory/3532-289-0x00000196801E0000-0x00000196802E0000-memory.dmp

Download