hxxp://br-rio-anx-r007[.]router[.]teamviewer[.]com

Analysis

max time kernel
899s
max time network
729s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://br-rio-anx-r007.router.teamviewer.com
Sample260809-dt9q2agq21

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1324	msedge.exe

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-19	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307191816997976"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\NumberOfSubdomains = "1"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "3095"	SearchHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\DOMSTORAGE\BING.COM	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHo = 6801000088020000	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{88482B2D-C85F-406F-8169-E104F2719FD3}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\DOMSTORAGE\MICROSOFTWINDOWS.CLIENT.CBS	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "2986"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\NumberOfSubdomains = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs\ = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "3047"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "134231884278071768"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\Certificates	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Root\CTLs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "3047"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\CTLs	SearchHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\DOMSTORAGE\CLIENT.CBS	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000300000014000000494c200603000400540010001000ffffffff2110ffffffffffffffff424d36000000000000003600000028000000100000004000000001002000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8b8b8efc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff6c6c6c864d4d4d637c7c7cd6838383fd838383fd7c7c7cd64c4c4c636464647f0000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ff8f8f8fb64d4d4d64818181fa8f8f8ffe828282ff828282ff909090fe818181fa4e4e4e650000000000000000a2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ffa2a2a2ff4646465a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff3636363a818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ff36363639818181fc828282ffa9a9a9ffffffffffffffffff949494ff828282ff818181fcb5b5b5ffb5b5b5ffc3c3c3fff6f6f6fffffffffffffffffff6f6f6ff4d4d4d5a7c7c7cd5939393fdffffffff9b9b9bffb3b3b3ffffffffff858585ff7c7c7cd5b5b5b5ffb5b5b5fff6f6f6fffafafaffccccccffccccccfffafafaffa9a9a9b74b4b4b60828282f98f8f8ffd828282ff828282ff909090fd828282f94d4d4d62b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffff656565864b4b4b607a7a7ad4818181fc818181fc7a7a7ad44c4c4c6266666686b5b5b5ffb5b5b5ffffffffffdadadaffb5b5b5ffb5b5b5ffdadadaffffffffffb6b6b6ff858585b64444445936363638363636384d4d4d5a8b8b8bb78a8a8adfb5b5b5ffb5b5b5ffecececfffafafaffccccccffc7c7c7fff6f6f6fff6f6f6ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffc3c3c3fff1f1f1fffffffffffffffffff6f6f6ffc3c3c3ffb5b5b5ffb5b5b5ffa9a9a9ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000b5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb9b9b9ffbebebeffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffacacacffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000aaaaaaefb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb5b5b5ffb7b7b7ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000c4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffc4c4c4ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ffd3d3d3ff00000000000000000000000000000000a9a9a9efb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb4b4b4ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffb8b8b8ffacacacef000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000420000002a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004c000000ae0000004200000000000000000000001000000075000000c3000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb000000cb0000006a0000001e0000000000000005010101a5232323f28b8b8bf9c9c9c9fee3e3e3fee3e3e3fee3e3e3fee3e3e3fee0e0e0fea1a1a1fe080808f4131315624f4f5aad060609d9000000180000007a1f1f1ff5989898f3dbdbdbfce3e3e3fee3e3e3fee3e3e3fee3e3e3fedfdfdffe9c9c9cfe1b1b1bda1c1c1c66969696a8d6d6d6fa535353f2000000b9000000ec5b5b5bf6999999f7adadadfcb3b3b3edd9d9d9fee3e3e3fee3e3e3fe9f9f9ffe1d1d1dd8292929749f9f9fb7cdcdcdf9b7b7b7f6848484f6000000f7000000ff7b7b7bfe979797fe979797fe979797fa9d9d9df9adadadf09a9a9afb0f0f0feb2121216b989898bab0b0b0ecb1b1b1fcb0b0b0fd888888fe000000fe000000f86c6c6cfb979797fe979797fe979797fe949494fe6a6a6afe090909eb10101065858585b0aeaeaef6b0b0b0feafafaffea6a6a6fd3f3f3fee000000bb0000009c2f2f2ff28a8a8afc979797fe959595fe696969fe131313d81212126c565656ab898989f5959595f9a1a1a1fe767676f53d3d3df8040404c6000000250000001a060606be303030f46b6b6bfa656565fe121212da17171774585858ba7e7e7efe7e7e7efe7e7e7efe797979fe0e0e0ee6000000840000002b00000000000000000000001e00000099050505f4050505f410101066585858b77d7d7dfc7e7e7efe7e7e7efe7e7e7efe1f1f1fed000000b90000000c0000000000000000000000000000000300000049000000cb0000004e191919a15b5b5bfc686868f8686868f85f5f5ffb222222ee000000ca0000001e000000000000000000000000000000000000000900000067000000490000000500000072010101ae0e0e0ecd0e0e0ece020202b6000000830000001e000000000000000000000000000000000000000000000000000000090000000300000000000000040000001900000030000000310000001f00000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000000c0000000c000000000000000000000000000000000000000000000000000000000010000000100000001000000010000e0010000e0010000e0010000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000c001000080000000000000000000000000000000000000000000000080010000c0030000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000003000000040000002c000000010000000000000001000000000000000100000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\PersistedTitleBarData\Microsoft.MicrosoftStickyNotes_8wekyb3d = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\CRLs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\Certificates	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\Certificates	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\TrustedPeople	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust\CRLs	SearchHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\DOMSTORAGE\WWW.BING.COM	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\Disallowed\CRLs	SearchHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\DOMSTORAGE\TOTAL	SearchHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\EDPDOMSTORAGE\CLIENT.CBS	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\ = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2986"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs\NumberOfSubdomains = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "0"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "2986"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\trust	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs\Total = "0"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "3047"	SearchHost.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPCONTAINER\STORAGE\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INTERNET EXPLORER\EDPDOMSTORAGE\MICROSOFTWINDOWS.CLIENT.CBS	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
244	msedge.exe
244	msedge.exe
1172	explorer.exe
1172	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe
Token: SeShutdownPrivilege	1172	explorer.exe
Token: SeCreatePagefilePrivilege	1172	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
1032	sihost.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe
1172	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1172	explorer.exe
1524	SearchHost.exe
3148	StartMenuExperienceHost.exe
1172	explorer.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 5044	2924	msedge.exe	80
PID 2924 wrote to memory of 1324	2924	msedge.exe	81
PID 2924 wrote to memory of 2044	2924	msedge.exe	82
PID 2924 wrote to memory of 2044	2924	msedge.exe	82
PID 2924 wrote to memory of 2044	2924	msedge.exe	82
PID 2924 wrote to memory of 812	2924	msedge.exe	83
PID 2924 wrote to memory of 812	2924	msedge.exe	83
PID 2924 wrote to memory of 4008	2924	msedge.exe	84
PID 2924 wrote to memory of 4008	2924	msedge.exe	84
PID 2924 wrote to memory of 4008	2924	msedge.exe	84
PID 2924 wrote to memory of 572	2924	msedge.exe	85
PID 2924 wrote to memory of 572	2924	msedge.exe	85
PID 2924 wrote to memory of 572	2924	msedge.exe	85
PID 2924 wrote to memory of 1492	2924	msedge.exe	88
PID 2924 wrote to memory of 1708	2924	msedge.exe	89
PID 2924 wrote to memory of 2844	2924	msedge.exe	90
PID 2924 wrote to memory of 1492	2924	msedge.exe	88
PID 2924 wrote to memory of 1492	2924	msedge.exe	88
PID 2924 wrote to memory of 1708	2924	msedge.exe	89
PID 2924 wrote to memory of 1708	2924	msedge.exe	89
PID 2924 wrote to memory of 2844	2924	msedge.exe	90
PID 2924 wrote to memory of 2844	2924	msedge.exe	90
PID 2924 wrote to memory of 4768	2924	msedge.exe	91
PID 2924 wrote to memory of 4768	2924	msedge.exe	91
PID 2924 wrote to memory of 4768	2924	msedge.exe	91
PID 2924 wrote to memory of 1792	2924	msedge.exe	92
PID 2924 wrote to memory of 1792	2924	msedge.exe	92
PID 2924 wrote to memory of 1792	2924	msedge.exe	92
PID 2924 wrote to memory of 3496	2924	msedge.exe	94
PID 2924 wrote to memory of 1852	2924	msedge.exe	95
PID 2924 wrote to memory of 3496	2924	msedge.exe	94
PID 2924 wrote to memory of 1852	2924	msedge.exe	95
PID 2924 wrote to memory of 4312	2924	msedge.exe	96
PID 2924 wrote to memory of 1612	2924	msedge.exe	98
PID 4312 wrote to memory of 4328	4312	msedge.exe	99
PID 2924 wrote to memory of 2388	2924	msedge.exe	100
PID 2924 wrote to memory of 1084	2924	msedge.exe	101
PID 2924 wrote to memory of 780	2924	msedge.exe	102
PID 2924 wrote to memory of 2952	2924	msedge.exe	103
PID 2924 wrote to memory of 2952	2924	msedge.exe	103
PID 2924 wrote to memory of 1776	2924	msedge.exe	104
PID 2924 wrote to memory of 1776	2924	msedge.exe	104
PID 2924 wrote to memory of 244	2924	msedge.exe	106
PID 2924 wrote to memory of 3700	2924	msedge.exe	107
PID 2924 wrote to memory of 3700	2924	msedge.exe	107
PID 2924 wrote to memory of 4872	2924	msedge.exe	108
PID 2924 wrote to memory of 4872	2924	msedge.exe	108
PID 2924 wrote to memory of 4476	2924	msedge.exe	109
PID 2924 wrote to memory of 4476	2924	msedge.exe	109
PID 2924 wrote to memory of 1716	2924	msedge.exe	110
PID 2924 wrote to memory of 1716	2924	msedge.exe	110
PID 1032 wrote to memory of 1172	1032	sihost.exe	116
PID 2924 wrote to memory of 2256	2924	msedge.exe	125
PID 2924 wrote to memory of 2256	2924	msedge.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://br-rio-anx-r007.router.teamviewer.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ff8ef57c188,0x7ff8ef57c194,0x7ff8ef57c1a0
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,8842720998439171103,8117747757332869501,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,9020629581833866212,14066653036032719359,262144 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,10831247892932023076,7588204394170476139,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:13
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,13161306498469776859,3641880353682979898,2097152 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,3983737969174931264,9846280245388792858,2097152 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,2919092735929815553,2976225610586973036,2097152 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,7456712677698933480,4281410052834406532,2097152 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4272,i,8870586094909065813,13399828059604319622,2097152 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4284,i,18040435053532424084,4703714101969484203,2097152 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:9
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5228,i,10171562429315670339,5669663849703129990,2097152 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,7589545223125293704,6722577193132650636,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:14
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,11210994118393979615,6077225844181406501,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,17946353672383179169,10836624154892997067,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,3597753716006128225,7793509240632707379,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,3597753716006128225,7793509240632707379,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,7248738978814891856,4121831700893373729,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,12694181127707265572,14452327230916512758,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,15077778249243550952,4593358214103835032,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,16589228802083336732,13772078768597878593,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:14
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,444435539200485100,12561437741897006576,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4816,i,14326041740075348521,10604720074239863726,262144 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,1796227442761442185,11651489013201666823,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,9623539085578197247,3832087801983404120,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,596349043110895491,2355337686204638391,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,4748034909331450955,12708983797872113881,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,4662318680221673322,16074765033530575684,524288 --field-trial-handle=2092,i,4587621743657399194,3795626183467223125,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
  2⤵
  PID:2256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4248

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1172

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3148

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 1c5f0577b7a028a239b63118704c3e110bb3638798afb62c4489d7321842e4f1
MD5 80ecf1b96e2d29eebac4d32d4c574f08
SHA1 a4df835447385c4269eebd6d6097ca86da6e15b0
SHA512 eeaf7057c7fab73097c0e38723188abd42eaafa0b2dee2bf5f1da72b46ac076ec49e3940402b52fc229a539244d245fc0959cf621911fd313f2a1aed17eae51e
TLSH
T1C3E0205C36E4C56CA642D487B17B4F14C1D27A4DDD5CC4D53A05789D2701800D3DDBF0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5333a8d72b320bf87e2fe6d62e5d60dca4fc6b09803550ae75270442f2e23d16
MD5 83349ebc2d15adc4f026efcffcda8427
SHA1 d772adead88ad4fce729ced426a51a60de85b35b
SHA512 994f57f5a6641053c5062f63bcfebd610cef2a36c2735f649a42b0c7fe6ae0ff45ac9d50feec78901a684b4e04fe76f93b04c8dc1ad76583c3e2ae295506e00b
TLSH
T1F2E0268D04D9C23EA640A4876374470CD2C47E4FDACCED8A2B04848C3649044B7CA9B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 45c6e9eb118b2a684a7d230a2a77b25f71cd702f8bbe2b55da78ea1dfb78391a
MD5 b02fadf430eaadeb12a9aef420f179da
SHA1 95d992bca41837ad124a1c0baa5bd0cbadd4aa5c
SHA512 59c34f0d0b15ce962e843ca24530ceb36e7dea7a7d0ad867f606c46c3a19a907393c731eaf84d761eaed349c7760980df1d3b33bcbd4eba1f9c0f2f94de66cdf
TLSH
T1D8E0208D44C5C25F9640644771545F0CC1C03F0F9EC4F9C9271489883302840EBC3AE4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 371dda02c16b05cc3ad97c6b37fbefc14e16746f4eeaa9fbf05ea867c44fe852
MD5 5ad3b52e0d9f14aeb1019efb3792c0a9
SHA1 7e98b798d12a5e4df0df35be8f378fc1535640ec
SHA512 8d867072e2f2da159a3df80db700dcd9c4bc26bbf52be29f5acd59e73d192669fb3353d068189bea2931e1841cca9a42f8edc96fb6e616a37285654238585676
TLSH
T1E6713BF62D8A0D53E360153BA0E852CC3573B3901A9F9E8CB284D6FE5615B5EC1FA90C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a3cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a3cd.TMP
Size 3KB
SHA256 46d23aecdef86b964715ab2b1792625b7f445d8524e9994c4bc2540374719522
MD5 37c6cf667b9a2420c733f586932bd5d4
SHA1 105d11c7a0c05c6aab442bd54435f11e1b901a6d
SHA512 bb662bd52a4c4edb2b6c6007b1c20d726b525ecccea95a9c8f7fbd3705161b67a5af9699cee80bcf6c54b83522edfd31e00817eb455e9df296d0f42f22a06e6d
TLSH
T196713AF62D8A0953E360193AA4E852CC3573B390199F8E8CB284D6FE5615B5EC1FA90C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 67ac5d9c1cbc6c0a01fc9748b3774eb1cfed261e4e4c4e98c948bc802cdef3c7
MD5 ba136597a06b7f4aca59fc272d9e7d0b
SHA1 2b7b7321d02bb38a955102962af25f0918e58a9a
SHA512 71c84cd053e7240526fb5a910be06c6f74851bcd09bf07cdddc484fd28ac72ed9eeabcfbcf631cae77820bb0467bcacf1b0aa9b707841d7eebf818c34d0eef50
SSDEEP 192:sxZiRCyM/jK1Ml8UQ/be/fgs0jIdphyg/W6+WNGhLA/Y0otU1+qIg5EJ:sxZi0qje/fgs08hP/bG2/5bdK
TLSH
T19E52E816AA345A77CCDFD209B955BF53D2F9047392900E48A9FCDA1C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6a4940508369e295de2e5cb6d0d5b9ae2dd67469dcc1401138ba3c2bebe94d32
MD5 b960f6982bbb9b7d7ca702abf7b059ac
SHA1 3cb48ae4948c4ee5a8862063094573a33df0517e
SHA512 131e3c905c1e8a4b149e046105c09a65409306e66092ee1f00d0ecd2f0953ccc2ca34f15b287cac5b5ed392d1692a7d54e07eeba88eef380da43c4a4362df87c
SSDEEP 192:sxZiRCyM/jK1Ml8Mbe/fgsbjIdpjyg/W6+WNGhLA/Y0ocj2+qIgrJ:sxZi0De/fgsb8jP/bG2/58d9
TLSH
T17B42E7126A346A77CCDFD209BA55BF53D6F9147392900D48A9FCDA1C04E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 72c8277d25a6e26fe4485c143bc4a3e06701d6f0180197c9ebfd7b55bf96fb20
MD5 a7f7052c3e2a3f1ac5615d3aa68d7450
SHA1 e121da4f1bb022105fb6071cf41a77eb72b26e41
SHA512 7060dd7d6e5e181e80d1eca7d5a7ecc63d36fc636574a27e5c6e6f1f53f786efb1be6130167fe3f1147ee8063b3987bba7bc42e294af4197f32c193dd44a2a7f
SSDEEP 768:Vfc0s8Ww2YfWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BOLl/TB0OPiro0z:Vfc0s8Ww2YfWRm/JQg1u1jaKBOLpTuO4
TLSH
T11DE20A3B284CCB7E4F840E9CED26AF966AD801CB66684D5447FE494C03C77EA521B49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\temp-index
Size 1KB
SHA256 14e97297717fb032ab70a6a529ae5be3f992b214571a5e9611cac4f0cb4d2bba
MD5 acf7b68137418297aaa431cbad9d3eee
SHA1 2763792c7d4b664a733c0b15803007ecbfb287d2
SHA512 f8ddceec7ce57748b475cac0089856a4e9266037406fe36758ebc5d36e8593930b8d6a8584f9774ca64ee45488c9258d28429420af06fe451f638bb8f953f757
TLSH
T11131954A8D90995FF85444B216B3B4A87770C9CC5761A2239C7C2132BD1236E1A9B1EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ceaa6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index~RFe5ceaa6.TMP
Size 1KB
SHA256 8625a0e08e0db1f5bc9b83d73e03014e5fd83631b14d42862a2ac7b062645560
MD5 3bd8608b7ba09d8e2241c083dafa7fb9
SHA1 0ce879c538d838288bf4dc1816ead447571ca563
SHA512 a8130b8c7504750b21cfdbc046a864ee6fdb466fc17f90c7db9cb42084205cb0fd951032a0de821bdfe76b03ed5fd343bb42b3e1936c6ac5cd08256ce1a9afbc
TLSH
T15231775A4E90891BE8C440770EE3A4B8333594404711B787947C5135FC717BE1E4E0D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b6c906ba8c27a68ec0b8b21a719a441f36d5399cf5c659ab2f1d69e011f2570d
MD5 397764e486251bc76dc0dc4ac14d9635
SHA1 51d8c52772e58bdfe56f64949c770163a2f27639
SHA512 dadb0c36f3fa1fd86ed26c8124f7fb1f393df5866c969136cc91d7d65c45b6073ae1358480eb11b65b18b82b93eee6629b91f73c12c614d5b5044378f6d9e4ae
TLSH
T115E0C0FB2EF318A4E9AFE3C614B244F40900385CC080FE1F502AA2CB10B13A42887C52
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d798375bca582bffd58730fc22a3a541197adb1b0332c0f95585605a218331ef
MD5 aee84fcf2b70f838e0b4b2799ad604b4
SHA1 ee0604a62ccc0237961fa2927196eb28c611797b
SHA512 44748646e552ed1d60a6c478811502d9265855f56d811250ca655d6a2e20328e11056eacb3d9bc8f1d7054e74a8805f1323b08188cc935aba692224cea2c28d5
SSDEEP 96:KEoAKlmKaQgK9amJqKysKWdspNnL/kPLOPJFkKxBJfk1tNun9:iTPklWdspNnL/qLOxFRBJf6tNun9
TLSH
T1A4B1635171BA02013C7FA90C91758A6A864234B33028B52B7BA941B31F7FE586EFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d28d78a279b83f7bb2037ca8201089a6f710b40bad0200aaedabdfa428bc858f
MD5 000491c1646b59085374b84ce8e5e049
SHA1 2de12235424c0e574aabfdce16759b57be7eca79
SHA512 75393423ae6e43bb976ce37fa11faaba3f3552132bcf21b703a497b2044647d3b7bf9450c08bbd725da6dfda87ba34ae9c030902ae6966a02434d164b3cc3b5a
SSDEEP 192:0jM6Y8NaUYlQ1aI6t9O9QmiU1gviw4JSufoPxzYc1oARSJr1G5Rh8qMU8:0i8NaU0RQki/Uu8YcWAoJr1GtqU8
TLSH
T1EC4228356868EC3B5DE7A255F54B3613DF7400279AC83F94D2ED2E1C01DB69C631B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 705bd6a2d02c8bb9e3ae03722ef63a35dd6470a2ae088d3f4285866a5d49c1b1
MD5 c17e20d3fc2627e045ef1c518f8bc745
SHA1 4ca82371e6847a0c3958afb5e8d1c445196eec7c
SHA512 4d6eccf45a66bc1f7bf6ce48cfb483313c0d29458fdff16328b77f2043076365f74a020396077cb6de1584a7cfbdc141f7afe7f33e4d40d160cb99ecdde426f9
SSDEEP 192:8r78NaUlQ1aI6t9O9QmiU1gviw4JSufoPxzYc1oARSJr1BFh8qMU8:88NaUlRQki/Uu8YcWAoJr1JqU8
TLSH
T1683228356868AC7B4DE7A295F54B3613DF740027DAC83F98D2ED2E1C01DB29C631B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 829e872bfeac509f6e6678094a497997aeb0cb2a08c14eaeccb5a3e55b9e7e49
MD5 d75573c6a0e8ae131ece49fbcdec37e7
SHA1 3fc2283180687d5394303a6e6d891f5892d074d0
SHA512 526acd9afafec818ae8b52131d434daa9625b64175fbf2a10f8df85ec18805a7601eee824c6f31dcce3b6b28b9f878b7b8c0a3298c45369d8ae112bd84706fc3
SSDEEP 192:0jME68NjYl/1aI6t9OuQmiU1gviw4JSufoPxzYc1oARSJr1yah8qMUt:0y8Nj0uhki/Uu8YcWAoJr1rqUt
TLSH
T1054219346868EC3B5DE7A255F58B3603DF784027DAC83F9496ED2E1C01DB59C631B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 688ad1e73920094b048fc4a2f7c2138a71fc221ea3e42d4e7993896dc22c60ee
MD5 da9ae840bb5eede1c69655c47c86bbcf
SHA1 24b7b8eb74ccdecaa0e0fdee699b676a98208c7e
SHA512 ee5e63151dc9de0e14215788165a8561aea3f896237745156671699f08a5af0c88e80ec8638d77e664a5111f01094d2125421a835f4f6e3ae9b82cf936166c08
SSDEEP 192:Mjr98NaUYlQ1aI6t9O9QmiU1gviw4JSufoPxzYc1oARSJr1BFh8qMU8:MF8NaU0RQki/Uu8YcWAoJr1JqU8
TLSH
T1AA3228356868EC7B4DE7A295F54B3613DF7400279AC83F94D2EC2E1C01DB69C630B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 bb4e339eb4028fe50d6402e0db9ec5daa949a84b54258b107d69bcfd9058876a
MD5 a750cc4a838f1a8df600740e67f5b339
SHA1 f20d5e4c0ce6608c478b042411eeb613f78182f2
SHA512 e33ac3b606ef429af8fe3188ca7a773722afba8797075ddb3e8e664f011041db22ca08f1aecef6d16ff1efc2e74fe34a43bbdb59a312b9767ba60c7ef88c7fe6
SSDEEP 192:0jM6Y8NvUYlQ1aI6t9O9QmiU1gviw4JSufoPxzYc1oARSJr1Hah8qMU8:0i8NvU0RQki/Uu8YcWAoJr1WqU8
TLSH
T1544229356868EC3B5DE7A285F54B3613DFB400279AC83F94D2ED2E1C01DB68C631B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 e65495b9a275047a7b13b95601fd94c34764fefcdc5e63ac388005b625e9b912
MD5 73ff3d35478354cb92a26a1966359df5
SHA1 3198a5b9774a1f1d593480c1650280544f7c36d6
SHA512 06d2273fd5aaa0928fbe6d0e8c345c3656ab0413bb5c7c42a5973534a28e4e0857fe8c3c103c75322676c9b83c94e2ebd698262e54a9c232de38c264a2380e77
SSDEEP 192:0jM6Y8NjYl/1aI6t9O9QmiU1gviw4JSufoPxzYc1oARSJr1Hah8qMU8:0i8Nj0uQki/Uu8YcWAoJr1WqU8
TLSH
T1794218356868EC3B5DE7A255F58B3603DF7400279AC83F9492ED2E1C01DB69C631B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 13945859fa77d8924175b36870e12cbcab9773573f14e3dd2d155dd8f23d6fba
MD5 d6a37cd8f3c978211223b2cfddace3c0
SHA1 07b7000509b8295cb65e47ec03d2604ea6521523
SHA512 edcc803ee4c28955cbee10bb9044033d804bfe273313d39d7aad7b0b92d7521e779ef0620007734246e0b91b3424373f295f907077a03248a7af359ad10a3fc3
SSDEEP 192:8r98NaUYKQ1aI6t9O9QmiU1gviw4JSufoPxzYc1oARSJr1BFh8qMU8:Y8NaU5RQki/Uu8YcWAoJr1JqU8
TLSH
T1633227356C68AC7B4DE7A295F54B3613DF7400279AC83F98D2EC2E1C01DB29C631B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 382cfcd6780cff1542c35d25354a4b88c0d8d06c39e43a5d445f137b7887ba9e
MD5 a75ff35c424a70a101be39d0de2bc61b
SHA1 c2c65a357470064b74e4e15de9e8c6b420c1185f
SHA512 ec44ab6153c574e961215d0371f784c4ee60c4a1618068bf0100698e369045290f3e9b0b1da045fc0e96b64866c5eebacfe8ac155b192138bbc6c960701aea8a
SSDEEP 192:XGNJ6jCQmiUyNIvef4SufoPxzYc1oNSn8iVU6:XGNJ6qWqefju8YcWOLVU6
TLSH
T1C502D739AC686C7B9EE3AE55F98637139FA5212BD9852F44DAF81F1C00D758C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 68adbef6ffea1e2aa9809f96c43b131bd42a860f0933384a790c4c79884d2ac4
MD5 dbaaa50612aa04449e644278e9cc7184
SHA1 c62782cee60e86f19261752abb2af0e338144181
SHA512 5013a99423ca42415fbf6a8545b562be3f96d346e4dd82f38edb32977f17de31edcf27e80296b407758da91f2a21a062c790ce01d657083ecae05750496d66c5
SSDEEP 192:BGNY6j0QmiUyHved4SufoPxzYc1oARSJr1zOM8qMU6:BGNY6Ygedju8YcWAoJr1LqU6
TLSH
T19D121835A868BC3B5EE7A591F58736139F641127DA893F84D6FC2E1C01EF59C630B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab90f801-b9cc-43e5-a78c-8db842fd9bfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ab90f801-b9cc-43e5-a78c-8db842fd9bfe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Y707T5EC\microsoftwindows.client[1].xml
Size 97B
SHA256 12f8cb64a0604580837cf36504d9d90678ecbd11cb3f5d3cb32a3708a9112a89
MD5 1d607e724c079aea243b20ee8f2d524e
SHA1 0f60c4dccfbaf337cc8fc840ecb2e48437476def
SHA512 e24f702af53223f2fb9bc165e5238e1804a064bdd0117967ba24351a461d8999202f8ab6ca7d4a38c3b46439025340d66c1ea21fca37a042061a90334ea8530b
TLSH
T1EDB092553D484C28174445AA2D1920E466A900A25206647424A4BC01B5C590AD411CA4
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftwindows.client[1].xml

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Y707T5EC\microsoftwindows.client[1].xml
Size 4KB
SHA256 5bd51e7ec4e8b2afafd5b5b69267a77c03810034fe06da833cd7a4144dcc74d8
MD5 4e111e6fbdb7a1c4632635b109ccb478
SHA1 24b1779c5b086b3575a38de261a2d08c88215576
SHA512 36eda5eaee2c6b2a553d4bc73b1fb40fdf73316056a9ad9c9f9f10c6c93fe8d3626e21bc77708978529bb3844689272c69d3e805165c2ae94ee21e3379aa10ef
SSDEEP 96:GE6ODu52+kJKgSHY7Zvb6OOu52/uauSvmsPVtshOGCC5rmgiHY+Zvb6Otu52kbOE:SgacvDIG1KBvRncvdL
TLSH
T12A91AB5DE3F20939803D3622EB51A78C73AFC723DBC263F164617A481B9664E9D538D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1524-352-0x000001A9F1470000-0x000001A9F1490000-memory.dmp

Download

memory/1524-341-0x000001A9F1150000-0x000001A9F1170000-memory.dmp

Download

memory/1524-382-0x000001A9F13F0000-0x000001A9F1410000-memory.dmp

Download

memory/1524-383-0x000001A9F1450000-0x000001A9F1470000-memory.dmp

Download

memory/1524-332-0x000001A9DDE00000-0x000001A9DDF00000-memory.dmp

Download

memory/1524-468-0x000001A9F60D0000-0x000001A9F61D0000-memory.dmp

Download

memory/1524-335-0x000001A9DDE00000-0x000001A9DDF00000-memory.dmp

Download

memory/1524-325-0x000001A9DDF20000-0x000001A9DE020000-memory.dmp

Download