ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d.exe
Size 950KB
Sample260703-thcj6acv6x
SHA256 ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d
MD5 a9c499afa0278279acd80597cbfc1e47
SHA1 5f7f11caf5992f370ed9657ff898b96fa4fe17ba
SHA512 4df0562be441485d24b280e62a04361d8a46daab1b16ae577b81c9b30b6155a9d899b91d4bdfcada8921f4a3dccefdde0e40731e7d01298a4ddcb345a08365f3
SSDEEP 24576:K+1mq2hh0vPWqKHeM5eJYdYsGN2U5JIxpZ5S:d328HjK+mMsG0Uc7rS
TLSH
T1F725F11B729911FAE0234174C9B75A05FBB2B4760774479F339C02A56F1B381AE3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
1448	cscript.exe

Loads dropped DLL 1 IoCs

pid	Process
1448	cscript.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\DriverStore\\cscript.exe"	cscript.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_1808715287\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_1587420538\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_1587420538\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_731587377\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6104_731587377\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5272	msedge.exe

Checks SCSI registry key(s) 3 TTPs 22 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275681952394390"	msedge.exe

Modifies registry class 39 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{684A55C7-E2AD-4118-8272-256538865514}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{0653B4FC-8D9F-4D6B-9E3D-7F050CCB3520}	cscript.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{43E622C5-8466-4E3A-B2AF-704D7C79D6CA}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2252	_ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d.exe
2252	_ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d.exe
1448	cscript.exe
1448	cscript.exe
1448	cscript.exe
1448	cscript.exe
3192	msedge.exe
3192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
6104	msedge.exe
6104	msedge.exe
6104	msedge.exe
6104	msedge.exe
6104	msedge.exe
6104	msedge.exe
6104	msedge.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3160	explorer.exe
Token: SeCreatePagefilePrivilege	3160	explorer.exe
Token: SeShutdownPrivilege	3160	explorer.exe
Token: SeCreatePagefilePrivilege	3160	explorer.exe
Token: SeShutdownPrivilege	3160	explorer.exe
Token: SeCreatePagefilePrivilege	3160	explorer.exe
Token: SeShutdownPrivilege	3160	explorer.exe
Token: SeCreatePagefilePrivilege	3160	explorer.exe
Token: SeShutdownPrivilege	3160	explorer.exe
Token: SeCreatePagefilePrivilege	3160	explorer.exe
Token: SeShutdownPrivilege	3160	explorer.exe
Token: SeCreatePagefilePrivilege	3160	explorer.exe
Token: SeShutdownPrivilege	3160	explorer.exe
Token: SeCreatePagefilePrivilege	3160	explorer.exe
Token: SeShutdownPrivilege	3160	explorer.exe
Token: SeCreatePagefilePrivilege	3160	explorer.exe
Token: SeShutdownPrivilege	3160	explorer.exe
Token: SeCreatePagefilePrivilege	3160	explorer.exe
Token: SeShutdownPrivilege	3160	explorer.exe
Token: SeCreatePagefilePrivilege	3160	explorer.exe
Token: SeShutdownPrivilege	3160	explorer.exe
Token: SeCreatePagefilePrivilege	3160	explorer.exe
Token: SeShutdownPrivilege	3160	explorer.exe
Token: SeCreatePagefilePrivilege	3160	explorer.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
6104	msedge.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe
3160	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3516	StartMenuExperienceHost.exe
3160	explorer.exe
2688	SearchHost.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1448	2252	_ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d.exe	88
PID 1448 wrote to memory of 6104	1448	cscript.exe	90
PID 6104 wrote to memory of 700	6104	msedge.exe	91
PID 6104 wrote to memory of 4260	6104	msedge.exe	92
PID 6104 wrote to memory of 5272	6104	msedge.exe	93
PID 6104 wrote to memory of 4260	6104	msedge.exe	92
PID 6104 wrote to memory of 4260	6104	msedge.exe	92
PID 6104 wrote to memory of 1432	6104	msedge.exe	94
PID 6104 wrote to memory of 1432	6104	msedge.exe	94
PID 6104 wrote to memory of 3176	6104	msedge.exe	96
PID 6104 wrote to memory of 3176	6104	msedge.exe	96
PID 6104 wrote to memory of 3176	6104	msedge.exe	96
PID 6104 wrote to memory of 3924	6104	msedge.exe	97
PID 6104 wrote to memory of 3924	6104	msedge.exe	97
PID 6104 wrote to memory of 3924	6104	msedge.exe	97
PID 6104 wrote to memory of 5556	6104	msedge.exe	98
PID 6104 wrote to memory of 5556	6104	msedge.exe	98
PID 6104 wrote to memory of 1924	6104	msedge.exe	99
PID 6104 wrote to memory of 5556	6104	msedge.exe	98
PID 6104 wrote to memory of 1924	6104	msedge.exe	99
PID 6104 wrote to memory of 1924	6104	msedge.exe	99
PID 6104 wrote to memory of 1628	6104	msedge.exe	100
PID 6104 wrote to memory of 1628	6104	msedge.exe	100
PID 6104 wrote to memory of 1628	6104	msedge.exe	100
PID 6104 wrote to memory of 2152	6104	msedge.exe	101
PID 6104 wrote to memory of 2152	6104	msedge.exe	101
PID 6104 wrote to memory of 2152	6104	msedge.exe	101
PID 6104 wrote to memory of 4524	6104	msedge.exe	102
PID 6104 wrote to memory of 4524	6104	msedge.exe	102
PID 6104 wrote to memory of 5968	6104	msedge.exe	104
PID 6104 wrote to memory of 5968	6104	msedge.exe	104
PID 6104 wrote to memory of 5536	6104	msedge.exe	105
PID 6104 wrote to memory of 5536	6104	msedge.exe	105
PID 6104 wrote to memory of 2460	6104	msedge.exe	107
PID 6104 wrote to memory of 4116	6104	msedge.exe	108
PID 6104 wrote to memory of 4116	6104	msedge.exe	108
PID 6104 wrote to memory of 1520	6104	msedge.exe	111
PID 6104 wrote to memory of 1520	6104	msedge.exe	111
PID 6104 wrote to memory of 1876	6104	msedge.exe	113
PID 6104 wrote to memory of 1684	6104	msedge.exe	114
PID 6104 wrote to memory of 3060	6104	msedge.exe	115
PID 1448 wrote to memory of 3160	1448	cscript.exe	116
PID 6104 wrote to memory of 4652	6104	msedge.exe	122
PID 6104 wrote to memory of 4652	6104	msedge.exe	122
PID 6104 wrote to memory of 4160	6104	msedge.exe	126
PID 6104 wrote to memory of 4160	6104	msedge.exe	126
PID 6104 wrote to memory of 3596	6104	msedge.exe	127
PID 6104 wrote to memory of 3596	6104	msedge.exe	127
PID 6104 wrote to memory of 3192	6104	msedge.exe	128
PID 6104 wrote to memory of 4084	6104	msedge.exe	129
PID 6104 wrote to memory of 4084	6104	msedge.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\_ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d.exe
"C:\Users\Admin\AppData\Local\Temp\_ecde892dbc28af620ba8e311fa9dd4c66521c7fe95e6aadacc7cd9a5bb57d32d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Roaming\Microsoft\DriverStore\cscript.exe
  cscript.exe //B //Nologo
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Registers new Windows logon scripts automatically executed at logon.
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\43b9b2e009b5.pdf
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffb0ba7c188,0x7ffb0ba7c194,0x7ffb0ba7c1a0
      4⤵
      PID:700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,16490691243092305857,17526226469332517372,262144 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,1133128184686038026,8584399372617369551,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
      4⤵
      System Time Discovery
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,17943258579763056606,5818834096428306820,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,9919796636990244729,16888202233852095141,2097152 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,13731805415546085121,16911088403605853268,2097152 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,6041711586776441502,1206023054825294947,2097152 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,8690512878808374580,7474235052876774843,2097152 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:9
      4⤵
      PID:1924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5416,i,12499976628479723398,15983493175496867548,2097152 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:9
      4⤵
      PID:1628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4288,i,6303608602851845141,15310984388609975550,2097152 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:15
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,5072360237722893561,15161520281900212084,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,15275783208511825828,1923637200168222755,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,10632163373917243206,13299569074572028255,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:14
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,15145875755057064278,12485275194412255574,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
      4⤵
      PID:1076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,15145875755057064278,12485275194412255574,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,445301732336764476,2106924530872601104,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,13508878259366985510,14462257764283223566,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:14
      4⤵
      PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,14456901902029830470,1513204414046654794,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,1877544539932172862,13648731144803868581,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=164 /prefetch:14
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,8369243948878022172,9611677793456359959,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,14407950538915497223,15670215830549364151,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,5588084504258959508,2478288661510866135,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,17605826001064089092,4427192258739667399,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:14
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6384,i,3478182178334705894,10468572044419060245,262144 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,9828134172021340938,15595787668508437817,524288 --field-trial-handle=2148,i,14668447014876129301,17925456305108602595,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:4084
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Enumerates connected drives
    - Checks SCSI registry key(s)
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:900

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3516

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 141bed1b07471853234a19b17c858ebaff571d2aaff353b9ff066259e85ece75
MD5 64078d8d6eaee33e9762baf15785c958
SHA1 487422913a306fdbdab30ead7a3f38c1408d6e2f
SHA512 21dbda88b88e0161dd8449abf25765f97bf2aea8928bd53f4028ef3fc46c96fe41a8f034617aa3c01a92729e78d6256a36559a153b9c9ebd90b45da4df405fec
TLSH
T1BC61952238734911DB6A8579A1D370953374BE924D036EB9F698B974CC87FF8D1C91B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599d40.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599d40.TMP
Size 3KB
SHA256 fb294326c6ee845921bd129d4c7b34c9b783ebade3a2806abd43ba0933abb70d
MD5 cfc0150177c2ce9f2de6083ca93a4d07
SHA1 9d6aba98bc27abe79769ec17fbcb21eb5ebb8509
SHA512 fb8d23a142fe5334aa67809392e9acf3de9d09d23e1cd235ce21344171bea03cb4a94f31cffe641f0e497ed9c74117d0b75c4f172fb247e54510f8b0668a990f
TLSH
T144615F6638734911CB6948B9A2D230953374BE914C036EB9F698BA74CC8BFF4D2C61B1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e72161afebd654b8363d67af45c98427e412a24e95a3a94877b0146e644ad8b4
MD5 467504eee238d598a8527a76d3989023
SHA1 163c335142080db8efae024a1f69ee9574582d2b
SHA512 18a026141fa285134172f30de58644fdacfbe5a80f4b2830054ccc1bfc96be7b3ea99f5dd1d710176fd4c932019096e065d51ce6e38282d15844d0dee7051676
TLSH
T17351CDF3C3E8856E8A0186F0BB147E2BCE2D0914832C3D5AC9E4AF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 112e713572ba1a13a1641bedee15af74da73ae9b517ec7d282cb35e492d3e9d3
MD5 cb8fcb71e2f4ca198fa947989f4eeef2
SHA1 7beb6ec850da84e7e09eab25c759e7370aeb6578
SHA512 c6e99a1625b8fec6a4678f90f7fdd209a7450dd9f4bb927225155b9cf9cd91ed2dc12ed79bf89b9071372c8866411de539def5de6ceb782ccf562426e4df9183
SSDEEP 192:sxRvRgyM/jK1Ml8wcq/fLsU3AMZuXzoA8p4f/g6+WNIY4kOwBAe0HG/IgtJ:sxRvGCq/fLsUQyp6/5IsOTe0a3
TLSH
T15862D9156A28593BDCDBD20DFA517F53D6F91573A2901E44AAFC8B0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e53d1bf968df0a3b3a0ff94b0a5c15f919b6877e1c3ea3c435f5d68583953b46
MD5 de35cfd7edc2eb7cab60ebf48336b7c8
SHA1 d257c3776262fbce293fc580fbff04b72b48edec
SHA512 3a5c12673d49b256f2a3428d2c5152c348e8d29bc13287681d91e5e2489121731478034fa08ef3f93037c63d2f3dada2ac5e81e47bd22325e657f651dc368782
SSDEEP 192:sxR0RgyM/jK1Ml8UQPcq/fLso3iMZuXzoA8pef/g6+WNIY4ROwBAe0HG/IgDXJ:sxR0GqEq/fLsoyypc/5IZOTe0at
TLSH
T1CD62D915A924597BDCDBD20DF9927F53D6F85573A2901E04AAFC8B0C01E7ADE221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ebb240e162673c307af20fea37290ae212cee62e20a934c103950dfa66db8865
MD5 e643a67e6c4f625ae7ef7357709fc2e7
SHA1 05b293fb7a0a5a199efd3f4bb9bbb0c06ba01251
SHA512 3369134dee73a382a7875103e0587f171da16fd47ebe8a3b2940d4eeef92c1d0d0c55748803132b0ef98acce82d8167195efc334aae6061143f0315497c53631
SSDEEP 192:sxR0RgyM/jK1Ml8wcq/fLso3AMZuXzoA8p4f/g6+WNIY4kOwBAe0HG/IgDFJ:sxR0GCq/fLsoQyp6/5IsOTe0aD
TLSH
T1A162D915AA24593BDCDBD20DFA517F53D6F85573A2901E44AAFC8B0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c2fd4c58fe1674728ba8481c7ebd780674de16b2fac294db3d0145235d9e5100
MD5 82100922acb5163b4738b52bdb80a933
SHA1 a9f30699c0921160090ad7b4e632fb39497939b6
SHA512 31bf6d577971ef5e20941a936b32264e9c02897cb2f5294d96ce85fc8880dceda2e0183c2a4acf05ec011409ab594d0eced2772eff614560d160359e6a97a150
SSDEEP 768:Tqi0NR7pLuL7C3WgNxfez8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvrzXNGsMroKTpk:Tqi0NHE7C3WgNxfezu1jaArz9GW5
TLSH
T103E2ED3B680CCB7E4F804E9CEC2A7E8A6DE802CF56D8C95447EA841C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3677f5d1-c506-44f7-973e-43bfaa69a9e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3677f5d1-c506-44f7-973e-43bfaa69a9e4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c3c8e43787553f343943ba9fdc5053d3c2216ada22e93ab66ac670c9257aa99f
MD5 f187cb51fffdd76844fa515455929b51
SHA1 0f7c6dbd9fc8999de5e1e9e5095c4a56c311f250
SHA512 ae2610bcbde766e69716854a9167570f6f7472e53501213c3278abd7d3b4f1ab814d723884b7046d42df30b2b49874a34a581d81f82c9c24b99f76dccacef5b5
SSDEEP 768:Arv+4UNbd23dPthi+Ok+AW+152MvSCa2WM+8rir9:Absbs313px2p7MDriR
TLSH
T19B03BF32D8A9A9778CB686C4B74B36137FB0559389C50B94CDDA2B0D068B6CD230BD77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d4e9471865d03e25ff96d6789ebb0f718639512cfb03d731b622e96ab2ba42a9
MD5 29101b33b11f3003b4f19b7dfaaaf47c
SHA1 6172136a0216d3c571d3c380eb79c33448bdd862
SHA512 1f10da0705279c79952f8ffccac789cbbfe163c6291bc75f7d99dc14f96bc0d1176eb4ac9bc17fb055c17b7dfe1896ef43414f608437a5ab2745766ecb20fad6
SSDEEP 768:qj+9O3OzZthi+OBGh/+AW+152MvSCaidKb9MH:J9O3O9DRpx2pyKb+H
TLSH
T198F2AE71985ADD738CE682D4B78B3756AEF021A388C51E48CDD9AF0D06C378D1B4AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b5554dc1d684911dfd3d9be74f4e247d683365f988e1f2812854bd93ada5e5b8
MD5 a1ee0967b92a2ad0447600e9127027ae
SHA1 78e60de8308bca2d00d56a1396645b7285a754cc
SHA512 1f1972016e17d8d5694e5091d2d4fc9f62d91468fa40c28991ba1916b2680cee98612caa9972398cbc58f4dd0e416926c9cf98e9a3f0ca275dca952948df44b0
SSDEEP 768:lj+9O3zHZthi+OBGhF+AW+152MvSCaidKb9MH:Q9O3zZDPpx2pyKb+H
TLSH
T152F2AE31985ADD738CA686D4B78B3756AEF022A388C51E44CDD9AF0D06C378D1B4AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d855c54d31eba2f2bd2c234c7712206036353a2be48ab12803a449afbefb3405
MD5 862f3215a083c9b9d4465b90640e8ead
SHA1 b8b21c72c4d1577cfff1a75c0fa3748fb033f703
SHA512 bb97fd8deef6cba204c2aad466c89f493d74446142fe58e39e194da6b6498dd20c497d25d4edfd4572acb56e772575fb1d0d6c72b828e8a794a73126772b8ff7
SSDEEP 768:DF1j+9N3zwgCz46hi+OBGhs+AW+152MvSCaidKb9MH:S9N3IbDepx2pyKb+H
TLSH
T15C039D72D85ACE77DCE287C4B74A7656EEE011A389C85D84CEC95E0D01C32DD0B4AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

43b9b2e009b5.pdf

Path C:\Users\Admin\AppData\Local\Temp\43b9b2e009b5.pdf
Size 66KB
SHA256 55f2cb10c9edad56ed856f51a2406945f3438d791567fb62c606e2e9696cfaa2
MD5 7f74026903871a6772cde53c44732bd3
SHA1 9e2649804e06e73d8786bf9d44fd692ebc314540
SHA512 123a7a89d61cdeecd6cdc3e4d740b8787fcda241f7da3d1e440ef021821d65dbad3638c76bc57baf9cba96eb2df9a21ddb6638c35411dd1012ef655a1628bc0a
SSDEEP 1536:etjYq+zsnfngED07SpJy4d+imlpaLROIuNRlVZI:MjYRzsfc7Sy4dhROBDS
TLSH
T12D63F1641AD33D420239004296442E57CCD798E7390FAD06F65D8B7B2F2AFE0AC766E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6104_1900359360\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppxState.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\DriverStore\AppxState.dat
Size 659KB
SHA256 e7acc05630d855b8ea57fd23be2e46c73d48f8de5006a28ec71ab302f1da1fdf
MD5 6058e20462440874bdc591bd0ffa08f3
SHA1 7127e5154e698747d93fd342e0ebf6dd565ce7dc
SHA512 511a3efb35cc6de9598d56bdf54b6f96e3248f1e355c44c950e78ed6e56cdf1b35b10836437be2612b9034b179bebf5d7250fd802e222181ce7f856ec8a0544c
SSDEEP 12288:1CuggwlMMHpqKHENMJ/8dik17W1T7VvTYkF9kpHmiidwqURBRDJIxpZiKiN:NPWqKHeM5eJYdYsGN2U5JIxpZ5S
TLSH
T1D1E4123D000C956965130481DEFABE45BCD9D2BF2A7D0116795E2AE5EF4F803BF0E9A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VERSION.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\DriverStore\VERSION.dll
Size 145KB
SHA256 00bd2beaa7ad06c5cb690fe096319321bf64814d81e0d9c68ee1acee86588555
MD5 1d2c65a1d859d74c0cc9bac4745a1c6d
SHA1 5f5e4d1cbe61799f5bf6c9f0a008fb90f9501358
SHA512 5d48f07470542b9555dd1fa03d2da82e0bc8bed7d73028944c66155a64c0903362546c4adc62a848a14cc758fa9ebee8f90819a72e75d52f6bfa9541158b3309
SSDEEP 3072:92gQ+Gxnir1xU8I2+DFZFgnDeQJ1ckVPxIiThyGP:92hhirzUhtHFgni
TLSH
T190E36C5BB3A501FBE5B79234C9671A46E772781107609BEF03A442352F273D49E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cscript.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\DriverStore\cscript.exe
Size 184KB
SHA256 7b3973fc3d78340af8dceec0cf8b626046eb4e36dcacca5f8164b39945f1c9df
MD5 f9d16f6a7b44d0e272f2b072eef2c40a
SHA1 bc74ae3c8df19d88c7a23b4d0b7d3526d6046362
SHA512 9ad38cbea2c68514ba824dc7f375189a05cf6a839212223ca098c9f54ef144c4b92e5c2bb072d43fd751ae7f9fb1fed6d323fbad60ce2dce397b8eb8d992754c
SSDEEP 3072:eeQ94lCMhOND74L0Xkt92AVWeFNCCs8cCGXfeV6IZxtt:eL4oMKD74L0XyVWeFNCCoTfUfZh
TLSH
T18304074A33E490D5E17A623C89564685EB7278352B2267DF13D482BE5F33BD87C38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1448-13-0x0000019EDAD40000-0x0000019EDAFA1000-memory.dmp

Download

memory/1448-15-0x0000019EDAD40000-0x0000019EDAFA1000-memory.dmp

Download

memory/1448-91-0x00007FFB2DF40000-0x00007FFB2E1A3000-memory.dmp

Download

memory/1448-20-0x0000019EDAD40000-0x0000019EDAFA1000-memory.dmp

Download

memory/1448-11-0x0000019EDAD40000-0x0000019EDAFA1000-memory.dmp

Download

memory/1448-12-0x0000019EDAD40000-0x0000019EDAFA1000-memory.dmp

Download

memory/1448-311-0x0000019EDAD40000-0x0000019EDAFA1000-memory.dmp

Download

memory/1448-14-0x0000019EDAD40000-0x0000019EDAFA1000-memory.dmp

Download

memory/1448-19-0x0000019EDAD40000-0x0000019EDAFA1000-memory.dmp

Download

memory/1448-21-0x0000019EDAD40000-0x0000019EDAFA1000-memory.dmp

Download

memory/1448-18-0x0000019EDAD40000-0x0000019EDAFA1000-memory.dmp

Download

memory/1448-17-0x0000019EDAD40000-0x0000019EDAFA1000-memory.dmp

Download

memory/1448-16-0x0000019EDAD40000-0x0000019EDAFA1000-memory.dmp

Download

memory/1448-214-0x0000019EDAD40000-0x0000019EDAFA1000-memory.dmp

Download

memory/2688-333-0x0000019F83640000-0x0000019F83660000-memory.dmp

Download

memory/2688-347-0x0000019F83890000-0x0000019F838B0000-memory.dmp

Download

memory/2688-322-0x0000019F80000000-0x0000019F80100000-memory.dmp

Download

memory/2688-334-0x0000019F93A90000-0x0000019F93B90000-memory.dmp

Download

memory/2688-366-0x0000019F93E10000-0x0000019F93E30000-memory.dmp

Download

memory/2688-320-0x0000019F80000000-0x0000019F80100000-memory.dmp

Download