hxxps://github[.]com/Konskylux/Monoxide

Analysis

user interaction
yes
max time kernel
66s
max time network
239s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/08/2026, 20:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/Konskylux/Monoxide
Sample260809-zkh3lsvhnd

Score

7^/10

bootkit discovery execution persistence ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000\Control Panel\International\Geo\Nation	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe

Executes dropped EXE 1 IoCs

pid	Process
1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
85	raw.githubusercontent.com
86	raw.githubusercontent.com
88	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3668	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5184	3220	WerFault.exe	234

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5092	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307820057280668"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-42486406-2033776002-1658862356-1000\{B5534868-9E9D-465D-B0F7-403960477F8D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-42486406-2033776002-1658862356-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Token: SeTakeOwnershipPrivilege	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1480	Monoxide x64.exe
1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
4264	OpenWith.exe
2364	OpenWith.exe
4824	OpenWith.exe
2484	OpenWith.exe
3920	OpenWith.exe
2340	OpenWith.exe
4468	OpenWith.exe
2644	OpenWith.exe
1208	OpenWith.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 3000	1696	msedge.exe	82
PID 1696 wrote to memory of 4956	1696	msedge.exe	84
PID 1696 wrote to memory of 5092	1696	msedge.exe	83
PID 1696 wrote to memory of 4956	1696	msedge.exe	84
PID 1696 wrote to memory of 4956	1696	msedge.exe	84
PID 1696 wrote to memory of 2748	1696	msedge.exe	86
PID 1696 wrote to memory of 2748	1696	msedge.exe	86
PID 1696 wrote to memory of 3292	1696	msedge.exe	87
PID 1696 wrote to memory of 3292	1696	msedge.exe	87
PID 1696 wrote to memory of 3292	1696	msedge.exe	87
PID 1696 wrote to memory of 4188	1696	msedge.exe	88
PID 1696 wrote to memory of 4188	1696	msedge.exe	88
PID 1696 wrote to memory of 4188	1696	msedge.exe	88
PID 1696 wrote to memory of 4236	1696	msedge.exe	89
PID 1696 wrote to memory of 2040	1696	msedge.exe	90
PID 1696 wrote to memory of 4236	1696	msedge.exe	89
PID 1696 wrote to memory of 4236	1696	msedge.exe	89
PID 1696 wrote to memory of 2040	1696	msedge.exe	90
PID 1696 wrote to memory of 2040	1696	msedge.exe	90
PID 1696 wrote to memory of 1656	1696	msedge.exe	94
PID 1696 wrote to memory of 1720	1696	msedge.exe	95
PID 1696 wrote to memory of 1656	1696	msedge.exe	94
PID 1696 wrote to memory of 1720	1696	msedge.exe	95
PID 1696 wrote to memory of 2340	1696	msedge.exe	97
PID 1696 wrote to memory of 4552	1696	msedge.exe	98
PID 1696 wrote to memory of 676	1696	msedge.exe	99
PID 1696 wrote to memory of 4552	1696	msedge.exe	98
PID 1696 wrote to memory of 676	1696	msedge.exe	99
PID 1696 wrote to memory of 676	1696	msedge.exe	99
PID 1696 wrote to memory of 1100	1696	msedge.exe	100
PID 1696 wrote to memory of 5068	1696	msedge.exe	114
PID 1696 wrote to memory of 5068	1696	msedge.exe	114
PID 1696 wrote to memory of 5068	1696	msedge.exe	114
PID 1480 wrote to memory of 1960	1480	Monoxide x64.exe	112
PID 1960 wrote to memory of 4208	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe	120
PID 1960 wrote to memory of 2680	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe	121
PID 1960 wrote to memory of 2220	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe	122
PID 1960 wrote to memory of 4836	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe	123
PID 1960 wrote to memory of 268	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe	124
PID 1960 wrote to memory of 3668	1960	諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Konskylux/Monoxide
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x29c,0x7fff1e99c188,0x7fff1e99c194,0x7fff1e99c1a0
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,16939742883210437297,6848427075422981055,524288 --field-trial-handle=2352,i,10027688570555657674,3910870511576493095,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,6342892749495331901,3819430921719036810,262144 --field-trial-handle=2352,i,10027688570555657674,3910870511576493095,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,1742392555480829877,9802863090592416316,524288 --field-trial-handle=2352,i,10027688570555657674,3910870511576493095,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,14933382798171942539,5097494065667930844,2097152 --field-trial-handle=2352,i,10027688570555657674,3910870511576493095,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,3804339976571062845,14799427236117238546,2097152 --field-trial-handle=2352,i,10027688570555657674,3910870511576493095,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,8103274186034885678,13234790382574133862,2097152 --field-trial-handle=2352,i,10027688570555657674,3910870511576493095,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,13302501492164948564,1455623091787252247,2097152 --field-trial-handle=2352,i,10027688570555657674,3910870511576493095,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,10435526685805516342,612102870944628683,524288 --field-trial-handle=2352,i,10027688570555657674,3910870511576493095,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,2021801183142738798,2976246818211206914,524288 --field-trial-handle=2352,i,10027688570555657674,3910870511576493095,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,12447771205046826891,12324190569870604257,524288 --field-trial-handle=2352,i,10027688570555657674,3910870511576493095,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,12447771205046826891,12324190569870604257,524288 --field-trial-handle=2352,i,10027688570555657674,3910870511576493095,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,1559924705844516748,9744606400832175124,524288 --field-trial-handle=2352,i,10027688570555657674,3910870511576493095,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6384,i,4139084854177983031,11961999884262148748,2097152 --field-trial-handle=2352,i,10027688570555657674,3910870511576493095,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,6747807130662864493,8248215670758580486,524288 --field-trial-handle=2352,i,10027688570555657674,3910870511576493095,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4204,i,6928987390997162965,2096504048474791038,2097152 --field-trial-handle=2352,i,10027688570555657674,3910870511576493095,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3844

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3868

C:\Users\Admin\Desktop\Monoxide x64.exe
"C:\Users\Admin\Desktop\Monoxide x64.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Local\Temp\諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
  "C:\Users\Admin\AppData\Local\Temp\諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\lt.txt
    3⤵
    PID:4208
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\sq.txt
    3⤵
    PID:2680
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\sv.txt
    3⤵
    PID:2220
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\th.txt
    3⤵
    PID:4836
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\7-Zip\Lang\va.txt
    3⤵
    PID:268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files\DebugStart.bat" "
    3⤵
    - Executes a command shell one-liner
    PID:3668
- - C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
    "C:\Program Files\Java\jdk-1.8\bin\wsimport.exe"
    3⤵
    PID:2612
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Java\jdk-1.8\jre\README.txt
    3⤵
    PID:2160
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe"
    3⤵
    PID:3520
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Program Files\Java\jre-1.8\lib\jsse.jar"
    3⤵
    PID:4292
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\Office16\1033\OutlookApptNaiveBayesCommandRanker.txt
    3⤵
    PID:1128
- - C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE
    "C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE"
    3⤵
    PID:1944
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt
    3⤵
    PID:1096
- - C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE
    "C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE"
    3⤵
    PID:4648
- - C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
    "C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE"
    3⤵
    PID:2040
- - C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BLANK.ONE"
    3⤵
    PID:1948
- - C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE"
    3⤵
    PID:4044
- - C:\Windows\hh.exe
    "C:\Windows\hh.exe" C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\OWSHLP10.CHM
    3⤵
    PID:4356
- - C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
    "C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe"
    3⤵
    PID:4156
- - C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe
    "C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe"
    3⤵
    PID:4572
- - C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe
    "C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe"
    3⤵
    PID:1284
- - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /layout:"C:\Program Files\Windows Media Player\Skins\Revert.wmz"
    3⤵
    PID:3748
  - - C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
      4⤵
      PID:4636
    - - C:\Windows\system32\unregmp2.exe
        
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        5⤵
        
        PID:2500
- - C:\Program Files\Windows Media Player\wmpnscfg.exe
    "C:\Program Files\Windows Media Player\wmpnscfg.exe"
    3⤵
    PID:4728
- - C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe
    "C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe"
    3⤵
    PID:3116
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe" "C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeGreaterThan.Tests.ps1"
    3⤵
    PID:768
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldContain.snippets.ps1xml
    3⤵
    PID:4112
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe" "C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1"
    3⤵
    PID:3824
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"
    3⤵
    PID:3220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 496
      4⤵
      Program crash
      PID:5184
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-mac.css
    3⤵
    PID:5348
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css
    3⤵
    PID:5376
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-gb\ui-strings.js"
    3⤵
    PID:5524
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\en-il\ui-strings.js"
    3⤵
    PID:5544
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nl-nl\ui-strings.js"
    3⤵
    PID:5588
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ja-jp\ui-strings.js"
    3⤵
    PID:5656
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ui-strings.js"
    3⤵
    PID:5676
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ui-strings.js"
    3⤵
    PID:5744
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\da-dk\ui-strings.js"
    3⤵
    PID:5768
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sk-sk\ui-strings.js"
    3⤵
    PID:5808
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-si\ui-strings.js"
    3⤵
    PID:5888
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\uk-ua\ui-strings.js"
    3⤵
    PID:5908
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ui-strings.js"
    3⤵
    PID:5976
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\css\main-selector.css
    3⤵
    PID:6024
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\zh-tw\ui-strings.js"
    3⤵
    PID:6060
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\it-it\ui-strings.js"
    3⤵
    PID:6088
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\ui-strings.js"
    3⤵
    PID:2932
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ru-ru\ui-strings.js"
    3⤵
    PID:5140
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ui-strings.js"
    3⤵
    PID:2324
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\combinepdf-selector.js"
    3⤵
    PID:1432
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ko-kr\ui-strings.js"
    3⤵
    PID:5188
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sk-sk\ui-strings.js"
    3⤵
    PID:5192
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\ui-strings.js"
    3⤵
    PID:2692
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pl-pl\ui-strings.js"
    3⤵
    PID:5128
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\ui-strings.js"
    3⤵
    PID:2868
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js"
    3⤵
    PID:2820
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\ui-strings.js"
    3⤵
    PID:2200
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\tr-tr\ui-strings.js"
    3⤵
    PID:5288
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\ui-strings.js"
    3⤵
    PID:5160
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\root\ui-strings.js"
    3⤵
    PID:5384
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\nb-no\ui-strings.js"
    3⤵
    PID:5320
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-cn\ui-strings.js"
    3⤵
    PID:5632
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\fr-fr\ui-strings.js"
    3⤵
    PID:5828
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fi-fi\ui-strings.js"
    3⤵
    PID:3368
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\hr-hr\ui-strings.js"
    3⤵
    PID:3068
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\ui-strings.js"
    3⤵
    PID:3376
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\ui-strings.js"
    3⤵
    PID:4236
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ro-ro\ui-strings.js"
    3⤵
    PID:3160
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ui-strings.js"
    3⤵
    PID:6196
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\tr-tr\ui-strings.js"
    3⤵
    PID:6324
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\da-dk\ui-strings.js"
    3⤵
    PID:6352
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\es-es\ui-strings.js"
    3⤵
    PID:6396
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\nb-no\ui-strings.js"
    3⤵
    PID:6440
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\ui-strings.js"
    3⤵
    PID:6520
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\ui-strings.js"
    3⤵
    PID:6596
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\nl-nl\ui-strings.js"
    3⤵
    PID:6616
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js"
    3⤵
    PID:6684
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sk-sk\ui-strings.js"
    3⤵
    PID:6712
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css
    3⤵
    PID:6760
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\ui-strings.js"
    3⤵
    PID:6812
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sk-sk\ui-strings.js"
    3⤵
    PID:6864
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-cn\ui-strings.js"
    3⤵
    PID:6884
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\hr-hr\ui-strings.js"
    3⤵
    PID:6952
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nl-nl\ui-strings.js"
    3⤵
    PID:6972
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\ui-strings.js"
    3⤵
    PID:7036
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\ui-strings.js"
    3⤵
    PID:7084
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dummy.dic
    3⤵
    PID:7136
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106031\javaws.exe
    "C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106031\javaws.exe"
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe"
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe"
    3⤵
    PID:6696

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5068

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3f0 0x2ec
1⤵
PID:4100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4264

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2364

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4824

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2484

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3920

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2340

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4468

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5092

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1052

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:860

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1848

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:676

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3316

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2204

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1408

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4540

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:572

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2248

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4548

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5032

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3804

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3292

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4916

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4724

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3820

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1544

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:896

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2612

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4540

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4148

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3844

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2840

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3848

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:372

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4332

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1548

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1352

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1656

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2220

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:184

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2364

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1548

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:460

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4756

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4724

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3856

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2324

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3116

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
PID:2220

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2324

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3104

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4000

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2324

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3220 -ip 3220
1⤵
PID:5132

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5156

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5256

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5048

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6264

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1652

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6608

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6860

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6008

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4772

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2544

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4144

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3376

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5256

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6708

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5244

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6860

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:572

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4f09b67f3cd537e58118f5452ece8461e4fe6705ee65ee2a25a297c3b63b0bb2
MD5 765cba8b92de06a5e3ee03ad2e048e84
SHA1 f7aac0e7083c9fc504bd693c1d2530ab32ad1193
SHA512 9bd946f03ace7132702508fe1e0072318ecad9b1f18ade2c03730a77b706954f5b7a08850763a06f99cc6ea30ab4142d02550e42fc402b2ad1fab26337c2daa2
TLSH
T1FCD02BF573445105C1455032DC000B2019540D4210EBD7025320048CB8044B5B6470C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4f5ef139065355dda6e570b51cc73f6355215f0abe5a572f0d0792323c6fbdcb
MD5 9184d9d9b5dbe8993de61edc497538f0
SHA1 e7949715970593c7ad30c567d42959a406489511
SHA512 6152d57919c9f3643ce35577bfa4dbf25991287c3f0604f191724b70e98356c0319f679cb645e7a6b2d70092fe975d1874cd9d0493d6af7516e6d14d0bca66a4
TLSH
T171D0C0A1772462C5D12810398D100A1019580E8311EBD30663100C4CDC340E2B5835C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 200KB
SHA256 0d1c5ead44e729aa9b25547bad1f128759d144b8ecdec25bb28d67d694a5b3e0
MD5 e77bca3013a7cdd34871d734a294d60b
SHA1 697b1f62007b9b9fbe6f1e98aede0e5800a6a6f7
SHA512 d9ff6c0fdc7cc2378b3de99abce734b6248c8c91fe78cd6c68cd5e84c6400beb0c5192eb9aa28fd22f60744e8c26d29fa5b6dad79296a1c84f0d2275a30628e2
SSDEEP 6144:p8ESSodSaIpdhPkHACXrDnBW+VAzZU8DIx:prSdwaItcRngPZ/DIx
TLSH
T131141276C16DAFCCADB70A92C2F9E81B1E98320E1BA1270583DF24378E546C146767D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 2bc34205d1aa3fff4e3aff78cafd184d6bf029c6837fdb541f56119f6cd85e2c
MD5 fe9492b73cfb0f4678c7fed5ce311349
SHA1 cc684f09ad9a40484cf068e785ae8bbb13c1f631
SHA512 8018bc492936e7ecb32d3a6feb7c491816283678453c2394478a408ec1963273cd554c350a81dfd3ef83ab7f1e2adee86c0d631a6aafc7b23c6fea8a45bf71cf
SSDEEP 48:xjZCK4GcDFabAB6LJvuHdvuvISpZJhVvU4w9dE2HWUX/d6nbSB6BGPlZXI0/gsju:5WbabAMFIkvH4E2xX14q64PXtzjeAM/V
TLSH
T1BBC1D3841E6A8860CBDFF07958D9D198B9B98E75D117CF6202D41EFFBA423ED1214B8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fa21f176372fa394fb5bd3efb2cd35492264e48999e1f2be74ff1f9c2bb1663c
MD5 b3a03945dc8fb51fd53fcd283a2c7362
SHA1 73de9b24adb74a8102886f47c5e5d02203f18738
SHA512 ed59d2a614dc44e1bbfd99d87fda8c57fbac2d9647762335c045da3059e24970f57bafef36aba90a75d5f7c7abf1633a1e4dede8a184f9c04cbe070b86be8125
TLSH
T1EC418BF787E2956D9E1256F0AA18EE2BCE2C0514831C787985E0BE57D3E3871E101B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 90b445a7ca11b4842dfd33915cede2f5697d3df40e3dab0970174391f6feb98c
MD5 2e6c4ed1810f5ed8f91cce4512e8d3d4
SHA1 dd9b7e00eddda7b49883b9af68f75e754784a2d3
SHA512 bf51904e81178c8fdae4a58c4e1e53e2cfcde5054a5126aa1f4e2fdfef4768acb23e5e36b25309e17314e0f32f54efdcf08d82cf815dd8c330ee5373739def9f
SSDEEP 192:sxZ/ZRIyM/jK1Ml8M98/fomsXZOIdp9VYHW6+WNYN6/YwwyMCrIgrJ:sxZ/Zq18/fRsXZfEHbD/p9
TLSH
T12D5208126A346A77CCDBD209F945BF53D6F5043292940E54AAFCDA1C04E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 539d19de49e74822524bc840aaae63106dc4bd3d045dc0b70ab406ac106f3327
MD5 b2f08dd2c7155f24a6339ca0fb27021d
SHA1 7160cd45065b51af4b5d1efe5aed8b34e11cbfa8
SHA512 bf0639063eece028232ec8934f998169e61451e60a50ac40574b406622441802aafdf7f08a361f6d58615a350c1f1e9be5d48868a5be7a2c8276517f033d9137
SSDEEP 192:sxZ/ZRIyM/jK1Ml8F98/fomsGWpVMZjIdp9VYHW6+WNNQN6/YIw4Ux1Igb/J:sxZ/Zqi8/fRsGWvMZ8EHbp/C9
TLSH
T1666209116A3459BBCDDBD20DFA96BF53D6F9042292900E549AFC991C00E7BED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2bb1d3ece301346ff2025591b09107d0c625ad075b1763451bcac21e944604ce
MD5 202738df0de4791761de1308f868a9ee
SHA1 ed777b00f5ca0259e580c7b87bff1d5a298dc582
SHA512 c75c555a104ba78b93a4b70271d747a710e348f2cff03a909247c0282b732f8a270471adc8d42d88ba7b971a650a2cc5bdb8e35bbbe4c4f5836c30d2d278bd16
SSDEEP 768:GL4TaXWWvyaZy8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvhLlJX65JroEyiTCxS:GL4TaXWWvyaZyu1jaihLHq5ipxS
TLSH
T13CD20B3B684CC77E4F840E6DEC2AAF976ED801CB57984D5447FA884C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a3c7295d93338a3ce1922a683b9ed3dc59d62cf5827d06e69b463aaa6ce08973
MD5 623b32f1c2497cc5bfad55834a4d0566
SHA1 a63f2849fd0bef8c1279fcca7c2ad71eb1f9e0fd
SHA512 b876edd9d05f42f29c7d047b9d295d78976143d7b7663d9a7f510b48d637c66ef928282d89b5528a3671d489ca7ac2531bc991f30f33e7573893ee88a828ce36
SSDEEP 96:KsOeOROAOkOeOQOwOx7OEOrOsJOsOxKhO4JO+OxtOGOOOzOsOwOSTtuKOkimr2KS:mJIrXJ7bc36rvF4Qpih5yvbS6lZl
TLSH
T1F2A1131336B9124138BE684C97A686774E4133773014EAAF7BE810A15E6BD512DFC9CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 de32cc6744d28e300d83c0518fbf7f808edf63e8a202e83123825db3c5b79e77
MD5 bb518446522722a5130a4cd6a45bdcf8
SHA1 5ff13a5ac3302727bc0daa9abbc32bf18f0ba50f
SHA512 88ade2a1eaa85a248d5009bd3cc1fb1c774579aba6492aad15655ac6af19e8720749742f7af85cb614ce77c1dade85cc1e3d83185567d02c4ded02730c258fa3
SSDEEP 384:dsNWkjoJHM04UiX1xcpwBy6tmb9vfEnTKwBODNZOCj5F:drN8nhjt89nEnewBKZOoF
TLSH
T1E5A24A7C9C699C3E489EB708B60E25274D68017BDAB05D7CE7E91B0CC2B564CF746922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 58db7db88fe8c00568b7490c59b4f2766e2ad75cda8be0f350a0ec0bb59206d2
MD5 87ad9b168df59e937a93ee4a95796528
SHA1 763671d65d781fb29de6ef94d47c6a362d60796e
SHA512 52f643da262cea0c431cebc13774f7213956c332ddfdcb4aadfdc8c978deed37d1d171f44e6f81de93b82a580437fc689ec79042785d272a6d36e989ab63385b
SSDEEP 384:MsNWkjoJHXA4UiX1xcpwZnTKwBODNZOCj5F:MrQ8nhZnewBKZOoF
TLSH
T1EA725C75A86CAC764DD3B005F00B32079EB451A7E7D42F74DAED7B1C02DA288630BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f038e5925590adb94e274f93db5ed412fd4eb52a5e815dd4af74dd3c5be48e05
MD5 f95b23e1a6b1754f81240bfb6b78cbbb
SHA1 0af39dbf9e4feebebb5ce0b95b01ee36be38a059
SHA512 bad167c4d0a25ab92fdb45bc958d3a16ab1833bfe923937e231749f5a557034a03ba080438ed98d1142014315074bd79e7fae7a3e7b7838273334eac136e2f9d
SSDEEP 192:mQJOND6zZU77QmiUyHSzmaU9X1oRYc9OwE5EU6:m2OND6t2txzmaU9X1xc9qyU6
TLSH
T158020939A869AC7B8EA3AD05B48B3B135FD4102BEBD56F94CAF81B1C41C724C1307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 20b36b818137185a78b33ba2879092d88e4c14ff9e6526db5108f85f1b71db3e
MD5 27b582fbc30be7e67ba19b860f79aaa3
SHA1 b3d148bfadfeebd536335838e674282bd15da4a7
SHA512 627f0509434a2816b53efc5287c53ed0d844f3930d5bedd784ddaa9f42823920197096217d1fd15b5346e2074564ace3c7ad72cab8ca81897dae72dee256d4a5
SSDEEP 192:+ONX6zZUL7QmiUyTSzIU9X1oRYcp8s/7qSU6:+ONX6tOttzIU9X1xcpHZU6
TLSH
T168122A35A4A8FC7B5D93A441F08736175FA4512BEB896FA0CAED2B1C02DF25C530B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 50a64410a4c78f7e75650a1ab548d072e20be2916530fb13d53d41afbdac1cd8
MD5 45469117b5a5855084e91e98fc89c69b
SHA1 7f34cca537b443f88a17b2a58dd9c79e4480ea05
SHA512 de33e0966193935b5eb692371ae26a31f0246c080ef3789ab4737598ff11b5778800fbf3b0fc9329aa0e26de8e2b766be84104a40c11350b22e579ca38da23c6
SSDEEP 768:f0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaE:RZP2tFPuNnY4UmqEMioTaBacg
TLSH
T177154137D190B085CF2C71B1E5ED5F08BA23B10712E052465FB8A67BBA633C99D1B1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 ff00c0b2a1597c5496100eaeec29fbf752c0560e9188c3133f43b554fac908cf
MD5 37e53f49cb1d0f038bd3e3c80250ff2c
SHA1 489da50e08ddea497e9f1d95951851fda80f0b71
SHA512 fb601f4dce5a95f6804ceef6013485971c9c614fac2f55857d50346f9c7a7241382a01d6eba009266ed919c708c90aa988eaef55564fe911cde0fcdeee6aa197
SSDEEP 768:W0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaW:4ZP2tFP3vqY8QqEMaTaBacg
TLSH
T132257437D190B0C5CE2CB171E9ED8F09BA23A10B11A052465FF8A57E7A533D99D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalMLS_3.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
Size 68KB
SHA256 540edfb556d9f4c2cde14f159421c435cea139d38131726d5e9639e21c5e7944
MD5 53b936bebfc6d8553d598c77c13f6b9d
SHA1 18c60cc3411696a0fb086780fdaa50467e5c4039
SHA512 47722771156de9028c2e07eda8d834839aeeee9b6542584313d6bda22f76d1842871956f4425596c2b9e1b4dfcaea027f711687986a6b58f7f9b5eb4d28b6262
SSDEEP 96:5ZNdJJFuTJltTRNXtuUMUstM7XtlUMbstCUMlstXOXtEL2t1LXt/tGAtmt:vNdJJ4TCnan3nS
TLSH
T11963F35162E4876EF3F7AEB46BFA55121E3A78905E35D20D0214424E2C61F7EEA30B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7b258b14b952efd6e41f5a637d16d1f390f89c62f5e7a4308b3487e660e1693d
MD5 9375e7e21ca3b197f8ccc12f4b12ad6e
SHA1 13091fcbf73c5ec80b45b786822f580c00f627a6
SHA512 dcda09c16a4b74e03c75b77fef93fc818f8fea0c50fc5a5848adf451340eaf8afa9ab49ad58785779eb9bf33a1c87907651075c4c11fc2f968f573a0f544f66f
TLSH
T1DF410B58A6EA1158B3B77E56AFF7A86D887F78772E06D45D00010D4F0A63B00C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 26c24a0e71725f1336a261303e2bbb565927998d18e02c9033d12652d185dd9d
MD5 68acffc589207a25d6bb99d3743fbeb7
SHA1 253d5e0b8d962db55c3a17323d961094dd943687
SHA512 086c27a05deaa8193540582269693f35ee87ac4c163f4a2f6970a6db6d6910a17e53007370e24d5ee30fa825bb3b6fade26f75d28303780a3fb90f3025adce25
TLSH
T1EF214C570A8E98B1C9A103E32DDC8E2573BBD7CE8750E066B289A03D4C0116D6B3E46D
MD5 SHA1 SHA512 TLSH

Submit Download

諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe

Path C:\Users\Admin\AppData\Local\Temp\諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.exe
Size 330KB
SHA256 ae9405b9556c24389ee359993f45926a895481c8d60d98b91a3065f5c026cffe
MD5 692361071bbbb3e9243d09dc190fedea
SHA1 04894c41500859ea3617b0780f1cc2ba82a40daf
SHA512 cfdd627d228c89a4cc2eac27dcdc45507f1e4265eff108958de0e26e0d1abe7598a5347be77d1a52256de70c77129f1cd0e9b31c023e1263f4cf04dbc689c87e
SSDEEP 3072:7/yvAAdLz9aha9RMXtdf+IBC2nQ4oUehONFlT7vJ333AlOi9E3AAqgm:z6dLzgiMXzBTJTDqlOi9E3AAqgm
TLSH
T13174C3027151DA99D8214130CC2ECAF67E227CE4C6B149E736F2BF7F7D7524269AA720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.txt

Path C:\Users\Admin\AppData\Local\Temp\諱螏闰狪敡溌蛽巪潶梩鼪誆戍褏姐怓.txt
Size 260B
SHA256 6ed68f294eb141bbe8c43ff47cfb9716418097a5f1de214743636b2a5ed4c09d
MD5 3e3c7fb167fb1d11563d0d32199388c3
SHA1 7318b7b20d85bbae26764dc967f429124a0c4eb1
SHA512 e99c21eac2ae9fb2aeb28330f90ae770bfd52c3fc1e333cd328e61c767a3ac833c9c0afb147310314346dedb97f82ebca1f9ece9e2c8c82889b3966fa26ad8cc
TLSH
T16FD002512DFBE762D3FEBFB4437D814060763810AD16928D8564868D0853B5DC474F27
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads