hxxps://www[.]mirrored[.]to/getlink/86841290/1000/?hid=WlhmZkg5MlY2MGROdmZNUlYxQm03Zz09KjoqSLYzBCoqcCLgaIz9eNCA7g%3D%3D&tid=f49036ccc33e9e3b592ceb5d7b7c1c62

Analysis

user interaction
yes
max time kernel
230s
max time network
233s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mirrored.to/getlink/86841290/1000/?hid=WlhmZkg5MlY2MGROdmZNUlYxQm03Zz09KjoqSLYzBCoqcCLgaIz9eNCA7g%3D%3D&tid=f49036ccc33e9e3b592ceb5d7b7c1c62
Sample260705-p7w8mscw21

Score

7^/10

defense_evasion discovery execution persistence ransomware

Malware Config

Signatures

Indirect Command Execution 1 TTPs 1 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
6052	forfiles.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
120	ipinfo.io
122	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5508	MSBuild.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4832	powershell.exe
200	powershell.exe
4796	powershell.exe
3216	powershell.exe
1016	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1832	msedge.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277299444017657"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{44DFCC76-A14B-4462-9D6B-0F9403644A6E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\tmp-81831-CSzPLcLKH3SC\ZIvIArwkM.5o:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-81831-CSzPLcLKH3SC\LuceneNet.csproj:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-81831-CSzPLcLKH3SC\Internal.targets:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-81831-CSzPLcLKH3SC\LuceneNet.csproj.user:Zone.Identifier	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\tmp-81831-CSzPLcLKH3SC\LuceneNet.Internal.props:Zone.Identifier	Setup.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5640	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe
200	powershell.exe
200	powershell.exe
200	powershell.exe
4796	powershell.exe
4796	powershell.exe
4796	powershell.exe
3216	powershell.exe
3216	powershell.exe
3216	powershell.exe
1016	powershell.exe
1016	powershell.exe
1016	powershell.exe
5332	msedge.exe
5332	msedge.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeIncreaseQuotaPrivilege	4832	powershell.exe
Token: SeSecurityPrivilege	4832	powershell.exe
Token: SeTakeOwnershipPrivilege	4832	powershell.exe
Token: SeLoadDriverPrivilege	4832	powershell.exe
Token: SeSystemProfilePrivilege	4832	powershell.exe
Token: SeSystemtimePrivilege	4832	powershell.exe
Token: SeProfSingleProcessPrivilege	4832	powershell.exe
Token: SeIncBasePriorityPrivilege	4832	powershell.exe
Token: SeCreatePagefilePrivilege	4832	powershell.exe
Token: SeBackupPrivilege	4832	powershell.exe
Token: SeRestorePrivilege	4832	powershell.exe
Token: SeShutdownPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeSystemEnvironmentPrivilege	4832	powershell.exe
Token: SeRemoteShutdownPrivilege	4832	powershell.exe
Token: SeUndockPrivilege	4832	powershell.exe
Token: SeManageVolumePrivilege	4832	powershell.exe
Token: 33	4832	powershell.exe
Token: 34	4832	powershell.exe
Token: 35	4832	powershell.exe
Token: 36	4832	powershell.exe
Token: SeIncreaseQuotaPrivilege	4832	powershell.exe
Token: SeSecurityPrivilege	4832	powershell.exe
Token: SeTakeOwnershipPrivilege	4832	powershell.exe
Token: SeLoadDriverPrivilege	4832	powershell.exe
Token: SeSystemProfilePrivilege	4832	powershell.exe
Token: SeSystemtimePrivilege	4832	powershell.exe
Token: SeProfSingleProcessPrivilege	4832	powershell.exe
Token: SeIncBasePriorityPrivilege	4832	powershell.exe
Token: SeCreatePagefilePrivilege	4832	powershell.exe
Token: SeBackupPrivilege	4832	powershell.exe
Token: SeRestorePrivilege	4832	powershell.exe
Token: SeShutdownPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeSystemEnvironmentPrivilege	4832	powershell.exe
Token: SeRemoteShutdownPrivilege	4832	powershell.exe
Token: SeUndockPrivilege	4832	powershell.exe
Token: SeManageVolumePrivilege	4832	powershell.exe
Token: 33	4832	powershell.exe
Token: 34	4832	powershell.exe
Token: 35	4832	powershell.exe
Token: 36	4832	powershell.exe
Token: SeDebugPrivilege	200	powershell.exe
Token: SeIncreaseQuotaPrivilege	200	powershell.exe
Token: SeSecurityPrivilege	200	powershell.exe
Token: SeTakeOwnershipPrivilege	200	powershell.exe
Token: SeLoadDriverPrivilege	200	powershell.exe
Token: SeSystemProfilePrivilege	200	powershell.exe
Token: SeSystemtimePrivilege	200	powershell.exe
Token: SeProfSingleProcessPrivilege	200	powershell.exe
Token: SeIncBasePriorityPrivilege	200	powershell.exe
Token: SeCreatePagefilePrivilege	200	powershell.exe
Token: SeBackupPrivilege	200	powershell.exe
Token: SeRestorePrivilege	200	powershell.exe
Token: SeShutdownPrivilege	200	powershell.exe
Token: SeDebugPrivilege	200	powershell.exe
Token: SeSystemEnvironmentPrivilege	200	powershell.exe
Token: SeRemoteShutdownPrivilege	200	powershell.exe
Token: SeUndockPrivilege	200	powershell.exe
Token: SeManageVolumePrivilege	200	powershell.exe
Token: 33	200	powershell.exe
Token: 34	200	powershell.exe
Token: 35	200	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe
2912	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3288	Setup.exe
3288	Setup.exe
2912	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 6004	4736	msedge.exe	88
PID 4736 wrote to memory of 3548	4736	msedge.exe	89
PID 4736 wrote to memory of 1832	4736	msedge.exe	90
PID 4736 wrote to memory of 3548	4736	msedge.exe	89
PID 4736 wrote to memory of 3548	4736	msedge.exe	89
PID 4736 wrote to memory of 5256	4736	msedge.exe	91
PID 4736 wrote to memory of 5256	4736	msedge.exe	91
PID 4736 wrote to memory of 5648	4736	msedge.exe	93
PID 4736 wrote to memory of 5648	4736	msedge.exe	93
PID 4736 wrote to memory of 5648	4736	msedge.exe	93
PID 4736 wrote to memory of 3572	4736	msedge.exe	94
PID 4736 wrote to memory of 3572	4736	msedge.exe	94
PID 4736 wrote to memory of 3572	4736	msedge.exe	94
PID 4736 wrote to memory of 424	4736	msedge.exe	95
PID 4736 wrote to memory of 2436	4736	msedge.exe	96
PID 4736 wrote to memory of 424	4736	msedge.exe	95
PID 4736 wrote to memory of 424	4736	msedge.exe	95
PID 4736 wrote to memory of 2436	4736	msedge.exe	96
PID 4736 wrote to memory of 2436	4736	msedge.exe	96
PID 4736 wrote to memory of 2476	4736	msedge.exe	98
PID 4736 wrote to memory of 2476	4736	msedge.exe	98
PID 4736 wrote to memory of 2824	4736	msedge.exe	99
PID 4736 wrote to memory of 2824	4736	msedge.exe	99
PID 4736 wrote to memory of 2152	4736	msedge.exe	101
PID 4736 wrote to memory of 1072	4736	msedge.exe	104
PID 4736 wrote to memory of 1072	4736	msedge.exe	104
PID 4736 wrote to memory of 1072	4736	msedge.exe	104
PID 4736 wrote to memory of 5212	4736	msedge.exe	105
PID 4736 wrote to memory of 5212	4736	msedge.exe	105
PID 4736 wrote to memory of 5212	4736	msedge.exe	105
PID 4736 wrote to memory of 2752	4736	msedge.exe	106
PID 4736 wrote to memory of 2752	4736	msedge.exe	106
PID 4736 wrote to memory of 2752	4736	msedge.exe	106
PID 4736 wrote to memory of 2052	4736	msedge.exe	107
PID 4736 wrote to memory of 2052	4736	msedge.exe	107
PID 4736 wrote to memory of 2052	4736	msedge.exe	107
PID 4736 wrote to memory of 1352	4736	msedge.exe	108
PID 4736 wrote to memory of 1352	4736	msedge.exe	108
PID 4736 wrote to memory of 5964	4736	msedge.exe	110
PID 4736 wrote to memory of 5476	4736	msedge.exe	111
PID 4736 wrote to memory of 5764	4736	msedge.exe	112
PID 4736 wrote to memory of 3656	4736	msedge.exe	113
PID 4736 wrote to memory of 912	4736	msedge.exe	117
PID 4736 wrote to memory of 912	4736	msedge.exe	117
PID 3288 wrote to memory of 1284	3288	Setup.exe	121
PID 3288 wrote to memory of 1016	3288	Setup.exe	142
PID 3288 wrote to memory of 4044	3288	Setup.exe	125
PID 3288 wrote to memory of 4412	3288	Setup.exe	127
PID 4412 wrote to memory of 4832	4412	cmd.exe	129
PID 3288 wrote to memory of 4840	3288	Setup.exe	131
PID 4840 wrote to memory of 200	4840	cmd.exe	133
PID 3288 wrote to memory of 5412	3288	Setup.exe	134
PID 5412 wrote to memory of 4796	5412	cmd.exe	136
PID 3288 wrote to memory of 4452	3288	Setup.exe	137
PID 4452 wrote to memory of 3216	4452	cmd.exe	139
PID 3288 wrote to memory of 3844	3288	Setup.exe	140
PID 3844 wrote to memory of 1016	3844	cmd.exe	142
PID 3288 wrote to memory of 6052	3288	Setup.exe	145
PID 6052 wrote to memory of 3272	6052	forfiles.exe	146
PID 3272 wrote to memory of 3732	3272	cmd.exe	148
PID 3272 wrote to memory of 5764	3272	cmd.exe	149
PID 5764 wrote to memory of 5480	5764	conhost.exe	150
PID 5480 wrote to memory of 5508	5480	cmd.exe	151
PID 4736 wrote to memory of 5332	4736	msedge.exe	152

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mirrored.to/getlink/86841290/1000/?hid=WlhmZkg5MlY2MGROdmZNUlYxQm03Zz09KjoqSLYzBCoqcCLgaIz9eNCA7g%3D%3D&tid=f49036ccc33e9e3b592ceb5d7b7c1c62
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e4,0x7ffa7920c188,0x7ffa7920c194,0x7ffa7920c1a0
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,8088027465178188377,13931024819747308358,262144 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,8348878062448483107,7601765138147356650,524288 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,2145939913020622414,5403105376698650012,524288 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:13
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,17979446207841644572,17755896832062629933,2097152 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3668,i,10137521003529455067,11242066413446762610,2097152 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,9641703707364513756,2909267619401407298,2097152 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,15625763566693675360,11286856014073739115,2097152 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:9
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,1665093124044188747,7705000752426296925,524288 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,465296521309712576,11147769845606530608,524288 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,6497755442217004536,7570492388769193425,524288 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,6497755442217004536,7570492388769193425,524288 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6468,i,11724469340110904875,7560936825218082543,2097152 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6668,i,15664835079773690076,16093982680495860228,2097152 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4252,i,3739263985604143636,13097756630742931153,2097152 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6584,i,7480276056759089821,2162995923333532590,2097152 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,17006605842602381237,5327162933868522876,524288 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,9770710149937547069,8731214712776202149,524288 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=836,i,10204736173852009232,627779875033560090,524288 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:14
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,11136592321909575312,7584258802164889758,524288 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:14
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7288,i,11579994126568917758,2090753457635292779,524288 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:14
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,8378477966802137441,7955848097388725353,524288 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5420,i,16775277543122299406,15990107609097885751,262144 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,5522277441791907420,16946682166357888763,524288 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,8101122715323602565,9378293467453470848,524288 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,7808114823456514406,18129049627471256006,524288 --field-trial-handle=2140,i,3430131943123320759,13455279579751015663,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5240

C:\Users\Admin\Downloads\Archive_x64_640152\Setup.exe
"C:\Users\Admin\Downloads\Archive_x64_640152\Setup.exe"
1⤵
- Checks SCSI registry key(s)
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:1284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:1016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:4044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-PSDrive C | Select-Object Used,Free""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-PSDrive C | Select-Object Used,Free"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_Processor | Select-Object NumberOfLogicalProcessors"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1016
- C:\Windows\SYSTEM32\forfiles.exe
  forfiles.exe /p C:\Users\Admin\AppData\Local\Temp\tmp-81831-CSzPLcLKH3SC /m ZIvIArwkM.5o /c "cmd /c ren @file ZIvIArwkM.bat && call ZIvIArwkM.bat"
  2⤵
  - Indirect Command Execution
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Windows\SYSTEM32\cmd.exe
    /c ren "ZIvIArwkM.5o" ZIvIArwkM.bat && call ZIvIArwkM.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Windows\system32\where.exe
      where conhost.exe
      4⤵
      PID:3732
  - - C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" --headless cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp-81831-CSzPLcLKH3SC\ZIvIArwkM.bat" /launched
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5764
    - - C:\Windows\System32\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\tmp-81831-CSzPLcLKH3SC\ZIvIArwkM.bat /launched
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5480
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp-81831-CSzPLcLKH3SC\LuceneNet.csproj" /nologo /v:q
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5508

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Archive_x64_640152\log.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:5640

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indirect Command Execution

T1202

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a62888e535bd59e468de633587feb69758fd6ba2ed42b0832d94f471b1ea96ab
MD5 aa95662740cc4d05fccbf1d7fe49a8ad
SHA1 bdaa0691e120da6a2b19ec8586fe58201efcceb9
SHA512 3353a0f948c7d3d2ad291ecbce773d380a388a8661e4a33e229e4702a99c311c19f968f9cd346d983e1fd101caacbf6876674827d9a1dee03d33d23de71b7d1d
TLSH
T11661C595CDA24AA9F76503B705E159CD33F5CC89760F2FE0609AB375480B3D4A0B2D34
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 0662b03200f08b4d2a90de339157209ddc012835c2dd0a229636c2ef0a7d2fbd
MD5 89f24b1762a899763857b0c6e770d3cb
SHA1 d73f464de247ad4b605e4972e4baf3e149f0c2a4
SHA512 5874d205265dfde47c5dc1feaef6a3dc21d8a2a14fa4dfccb8733d55f01f35b912c2cf7f72d0692a21a6257de51551daa833a17d9d0a27e93cab893c23f0eb71
SSDEEP 192:DpvAFyn8DVI48niAVp32Lkj6IlRqv6JDVfG:DpvAFyn8DVI48niAVp32LkGIlRqv6JDM
TLSH
T14BD1AEF7C7E4862DC81256F1AB146E2BCD1D1E14432C3D2689E5DF4BA3E2471E246A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 54a14ff243572f12ebdc1bf3a057e218907608dcf5f1e2d59f31ae6947cfde94
MD5 18772fcd2d8274cab3a82770b68c6f15
SHA1 4ca6a3d98ce790d98c6104a37eb668cb55c2b2aa
SHA512 58362799d0cb916f8791f997092c0a31dde7f6e25339b756b4a5c48703d5db38693e4675d1d66d778a24c92abf1155d0c794410653f01aa449917cdd4d2915bd
SSDEEP 192:sxRiRayM/jK1Ml8woI/f4eisOhbR3E1j2hzoA8pTKolB/g6+WNEeQA/Jm/Y+WuFz:sxRiIOI/f4eisOhbNijjp/5q/RF/b
TLSH
T18172C856A538597BCCDBD209FA41BF53D2F95562A2905E44AAFC8B0C01E77ED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c471e873cf675504638337ef08d9337a778b255e7f18ea76ffee479f111a2d62
MD5 df6a7bce28deaf315ab2d98b452f0f95
SHA1 f1c0ab7dc8c41f3e101c1f51499947e29d80e203
SHA512 55c3c0c1e82acacffacf3ad9bad80bae0c774e27473e29a1989fff72fcaba019091a0c993a26132a49dd7ef0e8239b94e92519cfdcae0db8b18925670ff0a332
SSDEEP 192:sxRlRayM/jK1Ml8wFI/f4eisghbR6E1j2hzoA8pTKolB/g6+WNEeQA/Jm/Y+8uFE:sxRlIbI/f4eisghbsijjp/5q/vF/s
TLSH
T19A62C8066638597BCCDBD209FA45BB53D2F95562A2905E44AEFC8B1C01E77ED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f0c5e21134dccc09eda6616c8d570e8d84203e3930dddd2086b9e8c795210607
MD5 26275a5872c2937c71ee8a9d4500eaef
SHA1 2e78c439061ec80200154b978c505872d6072b4e
SHA512 1a4a8eb69ebc941f6dbd53728c1bb9e57b411eb36cc75072a806a97804acb492e5955b70b23e52eab70da83856975e6749e392a5ce578a3613560f815cc68702
SSDEEP 192:sxRiRayM/jK1Ml8wFI/f4eisOhbR6E1j2hzoA8pTKolB/g6+WNEeQA/Jm/Y+8uFZ:sxRiIbI/f4eisOhbsijjp/5q/vF/x
TLSH
T11762D916A638597BCCDBD219FA41BB53D2F85972A2905E44AAFC8B1C01D77ED2103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 335cf3c9f637c08ce5af6b9f97723dd356d6fc4fb1ff6539c59a9f0a0cd8e623
MD5 328472c33d21c9866eaf93760bc88194
SHA1 052e7226a91e0d0a5ed4b5d8651288f6f97664c5
SHA512 02fa624a228cdf4b376bcb9b9bd414ceedf11d5ad03daaefaa691681dda2e277d8fb09e6e1275d678ff1f800e8fbc7857c4501d39193dd71303bab53f29de3e1
SSDEEP 192:sxRiRayM/jK1Ml8UQRGoI/f4eisOhbR3E1j2hzoA8phKolB/g6+WNEeQA/Jm/Y+d:sxRiIq/I/f4eisOhbNijjv/5q/5F/b
TLSH
T15272D816A538497BCCDBD209F651BB53D2F85972A2905E44AAFC8B0C01E77ED2103C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 26d07a7473a7c1d56fb3289f97e26aae6302a77e19ef00a8438bf44c03ea504a
MD5 703b4a5e6b9f930e144e3e07bde078be
SHA1 0fa9802b08618f22dfb15d43b3005a49ba9553b1
SHA512 dcb0c4497e26ffaf0c3669f2d6b0a466a20ea11d4a0399270dda43fcd90a5939296c54141f0725ec7f1a99b1c9d7b1c9a6d737ccf3e855e99b0d02591b313531
SSDEEP 768:7dUhjgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIe0GFrod4X7:7dUhjgWgEyf3wu1ja9RG+dS7
TLSH
T136C20B3B640CC77F4F844A9DEC29AE976DD801CB9B588D5447EA890C03C77EB921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 3KB
SHA256 0a250a9bf910026fb6aff0d8df4defb6840978f1e734a7693aa8d9aadaae5654
MD5 3222781971e193a9765e2ab8170c411a
SHA1 5e245399b65ddec407e67958cf4b895a000df6c0
SHA512 db6c5720a66880149f8aed01b8e7c3506ddc0f89482cd05c02a6fa5798f89ef8e1cc780a4f8beb0cd327c3ae448bee5b64f015b0e6e1f0c1186266faaf85b34a
TLSH
T1AF815B87B97F2B40383D184A81A9D41B46813172709DB97BBB6860D25F67E005FFDACD
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 eafebbcba0d3787ef9a2e4a527902566fbc3d0f2105019abb6eaf05644d02805
MD5 6eaa028470ae742d3e03e6ad6976cb57
SHA1 840e3c2fcdc5ec039f1b0072bef7fcb98dec8821
SHA512 589d24f875ac543ef733e5c98599d397150cf47e7ecda8e543db1297dd1d985dd558eab8f2e1e90e0fda6945b795d31ab5fd16d9c32a55fa01e64d7c57ed8a64
SSDEEP 96:KkWkKvKq+l2K2cuTPZNbRRtWFKAg1tK4MgbtcjbylxWHjsJ9rhhdz:S3plTPZNbRRIFKR1nMgbCjbylxWHjsJr
TLSH
T139918747B57F2B41383D280A81A9D41B868131B2309DB97BBB6860D25F67E005EFDACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\8a480d0e-bacf-4569-8050-88420abcd7de\0
Size 10.0MB
SHA256 b07c90e80e1e987670e773c334d11a2848f6041b81668227b4da1bed584b10cc
MD5 10d1d90974c035c6f693add8202183ed
SHA1 137713a018161a8b1f1b315328b3648433a0bd02
SHA512 4eaa9953d556f72bf07e3c239a411938ac612b843788ba7772da838c845902e51e35db2b4438724d0701bc918dca0a4cd747dd6dde7a08e296d8ea1606d52ed7
SSDEEP 196608:M2m8YSx6vWpUP9oFoOvFiwxogx92FEoZg3Qmti+nWJ9jS7W5mMYgKJP2ineMqZ6z:Y8VUP9uokxoG2hQJWJQgYgOOiSW
TLSH
T1A6B63318D91EF2D6FBD335FCB9A151B39A3400B026ED612DF6243175BD85AC0AF28D92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\8a480d0e-bacf-4569-8050-88420abcd7de\4
Size 10.0MB
SHA256 e5b844cc57f57094ea4585e235f36c78c1cd222262bb89d53c94dcb4d6b3e55d
MD5 f1c9645dbc14efddc7d8a322685f26eb
SHA1 8c206a1a87599f532ce68675536f0b1546900d7a
SHA512 868d3a190f2723758d1a64498a4ac1f14b0297e16e731a0eec3a446b775c65cb8428ab33140cee13ef51e7bb3764b5ff1900cfb342a3dbf3fcc41dd6cdd9fcea
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3903.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3903.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9a5364a773a8037066c7f97ccf3618ad72776c0d2e1dda86e1e364ed7e517d8d
MD5 3efc910302dcdbce632597f934d6d23e
SHA1 220139e94f6b30c1379c2856164e94bd95cdd18e
SHA512 b643a9918d0cf05fb15de1b4965a0fc26cf61fb835302e10802802ddf9710736bb74aa8bb2ac1c0f0dba0292a6352acedfd2a7f1c4d6e8d0111bd114932b6a5a
SSDEEP 768:8j+9c3eRb+5ktVMcvnWgWWR+2SrXH78tRMLb9ME7:b9c3wJPWg1bSroub+E7
TLSH
T13BF2AE32A8555E738CF2C694B2067747BEF04297D2CD2B88C4DD5F0E469BAAD1703C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a457a626480c607e711478788ec01ed1f9cedeecd3419962fd430d5233f6fced
MD5 9d4ca1fbbf173e9823f81ba78fc4ed00
SHA1 1bf64401aa358c7336bd3aebd6bd3c3df525a222
SHA512 dbb8237effbb5148aed2941f7a5a3de92e31d84ba82972ac061d3cec6a3d11b57af17ff4ecb9301a5664c59d81704dcb6a100b69cda31a047790cdac8a3ea92b
SSDEEP 768:Orv+4UNbdp3lC5jMcvnWgWWR+2SrXH78tRk7+8rr6F:Obsb/3sJPWg1bSroODr6
TLSH
T15703BF32A8688973DCF2D685B20B76437FF44183D6C91B88C4D91B4D829F9DE2707D66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 e486deb64525c4fc3d727af576193444170b3a3debe30e532dc33eee1812e2ab
MD5 186be7ba40c8f669ee0752448ae499d0
SHA1 5f07f5f913ebebf14b4bcfa86630f5c2c01158a8
SHA512 7a69ae6a150857136d9bdaab38f48773c2d32f91cbdda96e5f50eec943b0114e3b6c3faa1918e72654d6d6376cbbebbb33338046e6cd86f58945ff43e17ce800
SSDEEP 768:frv+4UNbdm3e265ktVMcvnWgWWR+2SrXH78tRMLb9M5:fbsbw37JPWg1bSroub+5
TLSH
T17D13BE32A8689A738CF3D594B10B76437EF45287C6CD1B88C4DA5B0D469F8ED2707D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 f1e5a847608708bb4f52ae0a31e06e82a815e734b20411adcbdf8cccbb467b01
MD5 233cb1f30d3418419c06cc705987258c
SHA1 256786a9c86849b3e347407eb625bf9c97cb061e
SHA512 3e9c266875d8de54609e52576d4a65e53a4fa7af070132c65f46ea8b712d5800596f1ff7d5a416e56667bf47d562059033d9bc7b7d73fb9224b7a80f7eaecc3d
SSDEEP 768:4F1j+9F3Kwgu8b+5ktXMcvnWgWWR+2SrXH78tRMLb9ME7:v9F3aJPWg1bSroub+E7
TLSH
T177136CF258C74972C8AE8787B33D2E02AEFCC197B1895A44B3D95A0DCD875BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3e898013349c10ef02ccba6ade5a54dbc372b579d460c07e0861399fa9c61e57
MD5 8d906ef9259004a7ba51b6997aa25e01
SHA1 37f0cf5431a43099dfc811a811c6316171a2af24
SHA512 6b99a29ec56bb9d8c4fa7779b9ff1a2f599918d32fb4cd1f0ae178a2f04f5efaf2ff72b4f7fe661e796acb1037fa522a5d1ae80d776984093c100bf3d217f43f
SSDEEP 768:Uj+9K3zEb+5ktVMcvnWgWWR+2SrXH78tRMLb9ME7:D9K3EJPWg1bSroub+E7
TLSH
T14BF2AE32A8555E738CF2C684B1067747BEF04697D2CD2B88C4ED5F0E469BAAD1707C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b0dde23-f184-421d-a52e-b8fd3c130375.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3b0dde23-f184-421d-a52e-b8fd3c130375.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 98c010174b1a27bc74b7a27c16420c2ab7b9606da2a0a304008581b7d7bae8b3
MD5 c63f6c8e996f0dd578cc005bfddc7587
SHA1 0f8f6dccb5da70ad3fd746f1f237e14cd6a32e32
SHA512 41525f5832313119c0202ecdb651cf65a4499e5fa5eb38e03debc1eab5fb9aaa755b4a5f68f6377798c30348b97432313634abc705e6647e04125bba04934cb0
TLSH
T1E0318637F3DC8611CC9A003A10CDAC1036BAC7DB90DEDFAB6B84E255A93F699DE60150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6275360b4466dc0d95d9ba6e64a52c0889a2cc87a4d605df281f2c7c514cbc60
MD5 620f3f01af978d91be9c56cdb189800b
SHA1 1dbc6ff9905e4ebfab8ab20c2f33b5ee02034efe
SHA512 c18a4f59b6d81dd9116231440ba7ea2e1fc023c58f0eaab4a01ef73afd14b8e58d1fe37a628892bfbb90ce51655b2437e8072c2ccb8dbea72fca8075c3e0b46c
TLSH
T19E219837F3DC8224CC99403A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d7cbd695a0f6be6b68f02a919fbc280f17975cc95be499b92e596e0b352637df
MD5 76b749e273b6f96dd9a8442bcf57b88b
SHA1 c61ef0c6042446ecc4f0dfd4eb9849aa4ffe8d64
SHA512 194be9e2448fab192d89784f483a087a8737ecc991ba8f120313dd0900c0cdb52d544def538fba92781868f0e89407603b7ae964745709b339279ac59b97c932
TLSH
T1ED219837F3DC8614CCA9003A10DDAD0036B6C7CB40DECF5B6B81E159A42F298CF60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e7eb5bcd0a45620f317c4301f1a010cc912363c00fbde3062599396cf78707e5
MD5 7ebbb41fc39ef18d64f074e06685dc81
SHA1 87c367e6f4835b568abd46ddff6ea543c9876f2d
SHA512 959049aea1bd50a895c8836df1b7d76e39237bff3a38feb3c505b116bede99e4763bc412af3bdae4dff0eb822dc9116afbc4bef3d0ccc303863aa0695fa2c4be
TLSH
T1E1217633B3DC8224C899013A10DDAC1036B687DB40DECF9B6B81E159A82F298DFA0160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zrih3qk2.us5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zrih3qk2.us5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Internal.targets

Path C:\Users\Admin\AppData\Local\Temp\tmp-81831-CSzPLcLKH3SC\Internal.targets
Size 562KB
SHA256 90b0fb366c0271b35b27500906420f9b7ee48bb2717659b40406379e723e0fc7
MD5 0748cf23b3a0d388f226e1c9b4fd46d7
SHA1 ecea7e809b7f490014eb24c6839ace58bd2d866d
SHA512 ccd4fea2a8d049257e4a4b176a1cd4aaa1fdbaa389ad7f83d629d07a523f9ce72884f90d1e1978da189496fecdf2aac703a6e61f0df09993098dfac84ebf8c89
SSDEEP 6144:ownb//HYFNzeHLdPN54y1subibkFYJ2G0e:ownjHG
TLSH
T192C42FB895DB60E4F6AF852176EC7EA4047231C75BCA2EA0436CE1009BF9FD63E4548D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuceneNet.Internal.props

Path C:\Users\Admin\AppData\Local\Temp\tmp-81831-CSzPLcLKH3SC\LuceneNet.Internal.props
Size 307KB
SHA256 fb6fa859ba769aa902e044f31529c33f1f081e21aa407df91cdd7f822c19e4b3
MD5 05e0676adc26246fce68a026e64bf77b
SHA1 07d55b366f5c4503ba927d8dd020879b9e2c951f
SHA512 e0f880985e2fe5034a4a39d80db36c8648cc3d16cee41eb085183a36fb8d8605aa355299dcc5025f23f17e29b775bab7c9c94fc06c3d0108ad07db9400f5cc25
SSDEEP 3072:Uh2kZv40SYMGycRXFOOSvcJYBN3sI++HNRI:MZv40zMGycLOOSk8gkNC
TLSH
T19164FEF4D9EE10A1D28BC9112A7CBFB442F374D3DBDA3658136DE2518F68B722A0950D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuceneNet.Internal.props:Zone.Identifier

Path C:\Users\Admin\AppData\Local\Temp\tmp-81831-CSzPLcLKH3SC\LuceneNet.Internal.props:Zone.Identifier
Size 28B
SHA256 3ae4037a8fd8d2de21538efba26e4428961187d29a6cbbfbd7c60e76cf4bc9d6
MD5 c0c0eb75aca089cf8c188e9fb51417d4
SHA1 5641321c8bfdfe3b64d7361aff8c316196d5bc6e
SHA512 d284f57dcb6ccd96ae33c22c5efa89145ab526ec00079187e77869988c9a85f9a57db5b3e35b560538355038d9c9f3b6317b2f7bb30212fbb4630c43f0c4c816
MD5 SHA1 SHA512

Submit Download

LuceneNet.csproj

Path C:\Users\Admin\AppData\Local\Temp\tmp-81831-CSzPLcLKH3SC\LuceneNet.csproj
Size 9.0MB
SHA256 ed32930e17fd5b044d3f059d2a40379e9eea83c9465ea6abf100c8ab6f9ab1ae
MD5 b494b8cdc638f54c4f188993012e0986
SHA1 5d764789e31d1a682b0ecec003cd65527d657aa3
SHA512 d7ba546a1ad059f3dacf2b49a1649143f125466a6fa28f0bc74f25c450d906c5815fe0d199789bc6c2bf742c7cd42429f28c8bbb9c4c0e971661c7622c668b4a
SSDEEP 1536:nZyHIibOfaFZKDlEp6LFBpbX0JlLJ2m9L4/kMvRVY6Kz+cvJcElhrWmQviYfIxaI:Y
TLSH
T1E296C27A078087BAF3D447C4886B311E36F8E555BA242159B773A9EF7C1A8DB8078743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuceneNet.csproj.user

Path C:\Users\Admin\AppData\Local\Temp\tmp-81831-CSzPLcLKH3SC\LuceneNet.csproj.user
Size 565KB
SHA256 2904fb4b2bdbc47dcc03c575fd5410be713a09bf53589bf7dfdfe5b0764131ba
MD5 d82b3ad8a021112df94a8b14e3b59217
SHA1 627465efecbcf966d78cb43ed01627886eea4df5
SHA512 d7b201d94b1cb7be778d793b7f3f0c5e737085f24851b14d18e02ce1e5e04b0cc11c5d4c7c470bf370a12585dd369299f626eae639ffe71f4f678d9f99c2b661
SSDEEP 6144:MFhFrkH/X9jehiFqtsdgLl7fIMi7Ods0jk/UfeO+3DGW7Wm2Iik5C1:llF4szWm2IG1
TLSH
T11EC4A1F4E99E11B1E38BD94127BCBE6841F271D3DBCA315863BAE3558FA5B526B0400C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZIvIArwkM.5o

Path C:\Users\Admin\AppData\Local\Temp\tmp-81831-CSzPLcLKH3SC\ZIvIArwkM.5o
Size 1KB
SHA256 2adf05a4ed43a3d6a380326feb6adc10982acbd209e744f0623bdf2269ec5e0c
MD5 370bdd91d6cb2286579665f512711e58
SHA1 871057da3700d11f0b8382df9bc4277543ff4b80
SHA512 ea5404f2a533c8157d108464ad44dbd06509221e0ca9aa2eba778347bee5699d8a6388992868c0ae5e44560940d85e07cec2d3e496ddcfa22f91ba1ddb37911b
TLSH
T12F21BB97B522155DC4F072BA27B98733120EB2C33884F5BDB1C4C9AD749F46FAA912D8
MD5 SHA1 SHA512 TLSH

Submit Download

text.txt

Path C:\Users\Admin\AppData\Roaming\RenPy\Game-1738212058\sync\text.txt
Size 5B
SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
MD5 f4020e91252aafd4b18d8acd17f883db
SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
MD5 SHA1 SHA512

Submit Download

log.txt

Path C:\Users\Admin\Downloads\Archive_x64_640152\log.txt
Size 375B
SHA256 013f03646ae433f320475b3248b7cc6e7469d8b75a64fb850b585f59b58870bc
MD5 3e819b888fe623856ff129e9ce25452f
SHA1 5bfd3d75e4165cecca8ff0c2ab0ee06dfb9a58a5
SHA512 417790c7d7339e1bf1a0b2e7b53542027cd1ea2874ed75ab217fcf5ef19541e641cac6dd2111583933be0662dfa1a4e7af8df2aec608c1f9e7d8198f92837572
TLSH
T113E06881EE9140B79024970C1E422E6313845A8A0A8AF2C91E4425801ACC47ABB3C032
MD5 SHA1 SHA512 TLSH

Submit Download

memory/200-648-0x0000018E5CA50000-0x0000018E5CB02000-memory.dmp

Download

memory/2912-751-0x00000275CD4E0000-0x00000275CD4E1000-memory.dmp

Download

memory/2912-750-0x00000275CD4E0000-0x00000275CD4E1000-memory.dmp

Download

memory/2912-752-0x00000275CD4E0000-0x00000275CD4E1000-memory.dmp

Download

memory/2912-753-0x00000275CD4E0000-0x00000275CD4E1000-memory.dmp

Download

memory/2912-754-0x00000275CD4E0000-0x00000275CD4E1000-memory.dmp

Download

memory/2912-745-0x00000275CD4E0000-0x00000275CD4E1000-memory.dmp

Download

memory/2912-743-0x00000275CD4E0000-0x00000275CD4E1000-memory.dmp

Download

memory/2912-749-0x00000275CD4E0000-0x00000275CD4E1000-memory.dmp

Download

memory/4832-637-0x00000235FE160000-0x00000235FE17E000-memory.dmp

Download

memory/4832-632-0x00000235FE0F0000-0x00000235FE112000-memory.dmp

Download

memory/4832-638-0x00000235FE180000-0x00000235FE232000-memory.dmp

Download

memory/4832-639-0x00000235FE240000-0x00000235FE24A000-memory.dmp

Download

memory/4832-640-0x00000235FE5E0000-0x00000235FE60A000-memory.dmp

Download

memory/4832-641-0x00000235FE5E0000-0x00000235FE604000-memory.dmp

Download

memory/5508-706-0x0000000008B40000-0x0000000008BF8000-memory.dmp

Download

memory/5508-725-0x0000000005500000-0x00000000057EC000-memory.dmp

Download

memory/5508-701-0x00000000050C0000-0x00000000050F0000-memory.dmp

Download

memory/5508-700-0x0000000004F30000-0x000000000508A000-memory.dmp

Download

memory/5508-699-0x0000000002870000-0x000000000288A000-memory.dmp

Download

memory/5508-698-0x0000000000260000-0x00000000002A0000-memory.dmp

Download

memory/5508-769-0x000000000DD60000-0x000000000DDDC000-memory.dmp

Download