Overview
overview
8Static
static
3Furever-Do...up.exe
windows10-2004-x64
7Furever-Do...up.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
8Furever Dock.exe
windows10-2004-x64
6Furever Dock.exe
windows11-ltsc_2024-x64
8ffmpeg.exe
windows10-2004-x64
1ffmpeg.exe
windows11-ltsc_2024-x64
1Analysis
- max time kernel
900s - max time network
863s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 07:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
900 seconds
Behavioral task
behavioral2
Sample
Furever-Dock_1.5.0_windows-x64-prod-main-74d5d382-setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
19 signatures
900 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
900 seconds
Behavioral task
behavioral13
Sample
Furever Dock.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
900 seconds
Behavioral task
behavioral14
Sample
Furever Dock.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
900 seconds
Behavioral task
behavioral15
Sample
ffmpeg.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
ffmpeg.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
General
- Target Furever Dock.exe
- Size 109.8MB
- Sample260825-jd6bkayalg
- SHA256 fae3d81155b549bf32e5566c30c716bc9b0e89ffc67cff249a8497128918d52b
- MD5 b7cdf273bdbc78d385f18b217d286f23
- SHA1 31540ba6136c6975bf843c6dc570ac58bb98f701
- SHA512 85fde49ba8ea7d1d1d73501b79d4a99eb29ec0b0b26d26c5aaba9e53fc47bc60a14b77e87e480377cafb90bbdaf7da3e8226347a42a6a72f604f12aa3d31ddc5
- SSDEEP 3145728:CAv6LYD4+xMger4Dm8BUGwDSjtBBO2zcsAQo7:CAy0D4FgerpwwDSI2zcZQo7
- TLSH T1FF4801616B5A996CD09AC474838B8A724A7130DB0B35B9FF449496383F6DBF42F38319
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Furever Dock = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Furever Dock.exe --autostart" Furever Dock.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Furever Dock.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-gl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-lv.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-nn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-pa.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-ru.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_266604009\Microsoft.CognitiveServices.Speech.core.dll msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_959711369\Filtering Rules-CA msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1353856894\Sigma\Staging msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1056826829\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1056826829\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_959711369\Filtering Rules msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1353856894\Mu\CompatExceptions msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1353856894\Mu\Entities msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1353856894\Sigma\Social msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-bn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_487969041\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1353856894\Sigma\LICENSE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-sk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_487969041\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_959711369\Part-RU msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1353856894\Mu\LICENSE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1353856894\Sigma\Cryptomining msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1404876861\crl-set msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_2114097629\LICENSE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_2129018883\male_names.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_2129018883\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_181932963\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_959711369\Part-IT msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-es.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-hu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_2114097629\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_2129018883\passwords.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_181932963\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1353856894\Mu\Cryptomining msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1353856894\Sigma\Content msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-or.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-mn-cyrl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1353856894\Mu\Advertising msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-mul-ethi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-nl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-ta.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1404876861\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_2114097629\keys.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_2129018883\surnames.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-it.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_2129018883\ranked_dicts msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_2129018883\us_tv_and_film.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_181932963\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-cu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-be.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_2129018883\female_names.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_181932963\_platform_specific\win_x64\widevinecdm.dll.sig msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_959711369\Part-ES msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-en-gb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-hi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_487969041\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-ka.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1353856894\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_959711369\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-sq.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-uk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-hr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-la.hyb msedgewebview2.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{83DA09A9-2522-4D7E-B94F-22B0D0440F71} explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{E12C775A-ADB3-4AC5-9106-5C68D5CDB160} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3748 msedgewebview2.exe 3748 msedgewebview2.exe 1520 explorer.exe 1520 explorer.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2124 msedgewebview2.exe 2124 msedgewebview2.exe 2124 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe Token: SeShutdownPrivilege 1520 explorer.exe Token: SeCreatePagefilePrivilege 1520 explorer.exe - Suspicious use of FindShellTrayWindow 62 IoCs
pid Process 1560 Furever Dock.exe 1560 Furever Dock.exe 1560 Furever Dock.exe 1560 Furever Dock.exe 5636 sihost.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1560 Furever Dock.exe 1560 Furever Dock.exe 1560 Furever Dock.exe 1560 Furever Dock.exe 1560 Furever Dock.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe - Suspicious use of SendNotifyMessage 45 IoCs
pid Process 1560 Furever Dock.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1560 Furever Dock.exe 1560 Furever Dock.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe 1520 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4576 StartMenuExperienceHost.exe 200 SearchHost.exe 1520 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1560 wrote to memory of 2124 1560 Furever Dock.exe 89 PID 2124 wrote to memory of 3648 2124 msedgewebview2.exe 90 PID 2124 wrote to memory of 4164 2124 msedgewebview2.exe 91 PID 2124 wrote to memory of 4164 2124 msedgewebview2.exe 91 PID 2124 wrote to memory of 4164 2124 msedgewebview2.exe 91 PID 2124 wrote to memory of 4164 2124 msedgewebview2.exe 91 PID 2124 wrote to memory of 6068 2124 msedgewebview2.exe 92 PID 2124 wrote to memory of 2868 2124 msedgewebview2.exe 93 PID 2124 wrote to memory of 2868 2124 msedgewebview2.exe 93 PID 2124 wrote to memory of 2868 2124 msedgewebview2.exe 93 PID 2124 wrote to memory of 5840 2124 msedgewebview2.exe 94 PID 2124 wrote to memory of 5840 2124 msedgewebview2.exe 94 PID 2124 wrote to memory of 5840 2124 msedgewebview2.exe 94 PID 2124 wrote to memory of 5840 2124 msedgewebview2.exe 94 PID 2124 wrote to memory of 5840 2124 msedgewebview2.exe 94 PID 2124 wrote to memory of 4784 2124 msedgewebview2.exe 95 PID 2124 wrote to memory of 4784 2124 msedgewebview2.exe 95 PID 2124 wrote to memory of 4784 2124 msedgewebview2.exe 95 PID 2124 wrote to memory of 4784 2124 msedgewebview2.exe 95 PID 2124 wrote to memory of 4784 2124 msedgewebview2.exe 95 PID 2124 wrote to memory of 4404 2124 msedgewebview2.exe 97 PID 2124 wrote to memory of 4404 2124 msedgewebview2.exe 97 PID 2124 wrote to memory of 4404 2124 msedgewebview2.exe 97 PID 2124 wrote to memory of 4404 2124 msedgewebview2.exe 97 PID 2124 wrote to memory of 4404 2124 msedgewebview2.exe 97 PID 2124 wrote to memory of 4436 2124 msedgewebview2.exe 98 PID 2124 wrote to memory of 4436 2124 msedgewebview2.exe 98 PID 2124 wrote to memory of 4436 2124 msedgewebview2.exe 98 PID 2124 wrote to memory of 5756 2124 msedgewebview2.exe 102 PID 2124 wrote to memory of 5756 2124 msedgewebview2.exe 102 PID 2124 wrote to memory of 5756 2124 msedgewebview2.exe 102 PID 2124 wrote to memory of 3748 2124 msedgewebview2.exe 103 PID 2124 wrote to memory of 708 2124 msedgewebview2.exe 104 PID 2124 wrote to memory of 708 2124 msedgewebview2.exe 104 PID 2124 wrote to memory of 708 2124 msedgewebview2.exe 104 PID 2124 wrote to memory of 824 2124 msedgewebview2.exe 105 PID 2124 wrote to memory of 824 2124 msedgewebview2.exe 105 PID 2124 wrote to memory of 824 2124 msedgewebview2.exe 105 PID 2124 wrote to memory of 3708 2124 msedgewebview2.exe 106 PID 2124 wrote to memory of 3708 2124 msedgewebview2.exe 106 PID 2124 wrote to memory of 3708 2124 msedgewebview2.exe 106 PID 2124 wrote to memory of 3724 2124 msedgewebview2.exe 107 PID 2124 wrote to memory of 3724 2124 msedgewebview2.exe 107 PID 2124 wrote to memory of 3724 2124 msedgewebview2.exe 107 PID 2124 wrote to memory of 2788 2124 msedgewebview2.exe 108 PID 2124 wrote to memory of 2788 2124 msedgewebview2.exe 108 PID 2124 wrote to memory of 2788 2124 msedgewebview2.exe 108 PID 2124 wrote to memory of 1156 2124 msedgewebview2.exe 109 PID 2124 wrote to memory of 1156 2124 msedgewebview2.exe 109 PID 2124 wrote to memory of 1156 2124 msedgewebview2.exe 109 PID 2124 wrote to memory of 5604 2124 msedgewebview2.exe 111 PID 2124 wrote to memory of 5604 2124 msedgewebview2.exe 111 PID 2124 wrote to memory of 5604 2124 msedgewebview2.exe 111 PID 5636 wrote to memory of 1520 5636 sihost.exe 117 PID 2124 wrote to memory of 5944 2124 msedgewebview2.exe 124 PID 2124 wrote to memory of 5944 2124 msedgewebview2.exe 124 PID 2124 wrote to memory of 5944 2124 msedgewebview2.exe 124 PID 2124 wrote to memory of 3068 2124 msedgewebview2.exe 125 PID 2124 wrote to memory of 3068 2124 msedgewebview2.exe 125 PID 2124 wrote to memory of 3068 2124 msedgewebview2.exe 125 PID 2124 wrote to memory of 1228 2124 msedgewebview2.exe 126 PID 2124 wrote to memory of 1228 2124 msedgewebview2.exe 126 PID 2124 wrote to memory of 1228 2124 msedgewebview2.exe 126 PID 2124 wrote to memory of 1764 2124 msedgewebview2.exe 127 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Furever Dock.exe"C:\Users\Admin\AppData\Local\Temp\Furever Dock.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1560.4984.1235498047433693170 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a12⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView /prefetch:4 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x144,0x198,0x7ffb73b15fd8,0x7ffb73b15fe4,0x7ffb73b15ff03⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1692 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:4164
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2016 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:6068
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:2868
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3492 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1 /prefetch:13⤵PID:5840
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4024 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1 /prefetch:13⤵PID:4784
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4320 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a1 /prefetch:13⤵PID:4404
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4328 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2100 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:5756
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5156 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵
- Suspicious behavior: EnumeratesProcesses
PID:3748
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5176 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:708
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4652 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:824
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4880 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:3708
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5400 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1060 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:2788
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5468 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:1156
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5460 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:5604
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5528 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:5944
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5848 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:3068
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5936 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:1228
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView" --webview-exe-name="Furever Dock.exe" --webview-exe-version=1.5.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=5772 --field-trial-handle=1696,i,12995630158152612762,15791424002748337468,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:7ead1cc36e54b1acfc6e4a9c6026716d493f20a13⤵PID:1764
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5324
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:200
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4576
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:5716
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 be9a18485104d5fb16a0afec0b7cd47b2b2a62d2cf768d6365fac8d36a4305b6
- MD5 1bc168aa7b01e3917be52147bede5a18
- SHA1 fda9c76e9648c51450588ed0ff0645501727d32d
- SHA512 58f654364a0c9044f7633a9c4766ccb6bd5b62b08f463ad99c607cdbfdf028b9216d582b3e5671fafa01404186877523ad808111ef0b8ba57a4ec47bdb67b0f0
- TLSH T13FD0243333030174C03031731503F50C0440C15F4007414C743DCD1F5F140500F13441
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 b0ad48c1247999662098127753c1663461c6a69f8476d2e8ad3b2ee2ba407ed7
- MD5 a3bff737b68065a6ad2f3f5a867b66bb
- SHA1 56703bd24e3a0dcf7a24562b8c1f579fb54111cc
- SHA512 feaafc23b5703934c199fe3d8825aa07b674358312c17fbe9f717d35dc31560ff7834de8fe561213356cce777680fa6ec12c7e9d202399056e54d6ee25eae4d8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 96B
- SHA256 ee7b2aac4737368a2d65bd49bb245a3b24a32b632716d33263391717101b9a6b
- MD5 984b79f79f962e47583e2086081b2868
- SHA1 a2a0a57bb0fa5185220ba7a83cd3deb92a04153d
- SHA512 96a2bdfd58bce90b736e6b851ee18b8eb43afedcf145806e07b84e0af0067631801b00bf711c2d1ff1c284e156278a4da5ce563f0972c2ec5bfc3719f467650c
- TLSH T13CB002A6428E8517F657EBF4F4E605C4737A5DA04E430EC561E10FBDCC26B8E8213985
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe599188.TMP
- Size 48B
- SHA256 7b52bd900ae02e0501e23bf8817a2beba6b1842cab6d02c7bb8850857479b2df
- MD5 9b5ecddc82e6b6a69bb461ad0b421da9
- SHA1 48cf1a440b65a2a3bce267a62b46ef34b002c973
- SHA512 0e0bd68cd879a2b24453252704812859ac24bbc0bb30af7ab00e37f52a5767e5885e6b3055cc1f80d8ab5d690a4df6a843ead8e867b7350ebeb11a13a48786d6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Extension Scripts\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Extension Scripts\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\Network Persistent State
- Size 1KB
- SHA256 00e4bf48c1f61efb8c19805f5b42b5c7bb51f1656bc373a63a9421d98569f523
- MD5 2297f813e7ebe9d6cd0e62a92216827f
- SHA1 62e1ebb0073fa7cf51f98cb2e43ffd76a4310247
- SHA512 d2ed5f5fac817f64d4c1e2a9738a2af529a59e739e65586b976d69595b0cf6dbbdf52bc7f9cd8dc89a130d16578bfd31b9eb20a7f4acb36781b38f3f8d453ca7
- TLSH T1C0113BB643B0C57D8B1166A42A346D17CD3D0119A32C69378DDAEBE66BE24B2D11064B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\Network Persistent State
- Size 1KB
- SHA256 73860bbf911c22b39814db13db66d60be0fa13c4663b9ccb1455ad3396a97a40
- MD5 0156b49762b8f639f78bbeed33249e60
- SHA1 a7da8f272eb387d2cdd464240fc46bbab3b09c0a
- SHA512 9445627ed4d6efc341e3723dbda97b9f773b5b85da8a28a0283d4ae3a48a559e6fbb1812b28d74d655d6f579cd474ce05ae0617775223ce7937b30229549e936
- TLSH T161217DA683F0C67D8A1166E42B343D17CD3E0519932C6937CDDAEBE66BE2472D11064F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\Network Persistent State
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\TransportSecurity
- Size 524B
- SHA256 d03551d62886edce3ca311b161613b0449b1d21e2c8c4879211f547b2595769c
- MD5 42f005c8463ced2000abceb48eedf354
- SHA1 613e2cb06551c51b8122bca4391db4da163fe4b5
- SHA512 fbc578de32a14df865e7b228369e03e1dff839b00a40cd72c7170a28d6650932b9d7b65864ab50ff4672a288cec4d4980e1853e24eb965ee6dbec811838d520b
- TLSH T141F024E6813EF76B606C296F1C40B8C21B37A531415A28E4DB5283AEB0821F72A42462
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\TransportSecurity
- Size 522B
- SHA256 4cab3e7e73bd2573be5fcd9dd969dc8188045fd4172797e0b8cd354051189a83
- MD5 4d1479e5a45ad8d9b31a760279343a59
- SHA1 05c667fb33d5a54e90ef2cb498eedada3131e765
- SHA512 f06ed5dcbf546d0ffd5af8b7c0975a8712a7a8bb7edd49e7f2eb63b48ea1a603aad4bdbd9ef68d9f9a76d3631a2be33ec971c7fbe7128d6483c34b1f61f2c5aa
- TLSH T14EF0C9ABD13EF62B206C1A6F0C00F8C31B36E43162426CE4DA5382ADB0821F31A47422
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\TransportSecurity
- Size 524B
- SHA256 53eaf733b587839ed304e2f19f5b4e19e25d8d90132728f290a757ee1c40f309
- MD5 ba3ad0127865867e00fdfb1a0a6a8a11
- SHA1 7803f012bdc2fa2d077aaf355fb7ba5c6157d039
- SHA512 9a10d621927f336b84b056ab0882dde307616c2480721317fb4e3fed140e2a4e60b929a221c02bc7c95f3ffaddbdebeab83173b287066616aeffbdfae7a61b63
- TLSH T107F050EB817EF77B206C196F1C40BCC32B37B431515528F4DA62827EB0815F66546492
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\TransportSecurity~RFe59a406.TMP
- Size 524B
- SHA256 3d86cc4045ab8be28110ab1b47d8316860c3d295b484456bc5ca7abe337eab6b
- MD5 7e1e9a2de0e3ec61454f210bc654cd67
- SHA1 17549c49bb13f5fbf1fd020648ef3790eee6e5aa
- SHA512 6bab6c6120382a12a73b6cc89c3d0691c784ac3eab741c548edfc7087a6d029c9830e68ecd676958ab62fd4050bee674b922a7183a2761f95061d4fd9b1fccd5
- TLSH T113F024EAD13EF66B206D1D2B1C40B8831B77A531915128E0DA92836EB0C21E61A064A3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Network\b2074122-ca9c-4d6f-ab0a-a9c846e8ae7a.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\Preferences
- Size 6KB
- SHA256 4825587a8db70c59e6597ae3bf158afef52d7846e923955b7fe1c45b9e767933
- MD5 3c243e3b44945d9393ee58f1ee17cbaf
- SHA1 71b48a8968c912ef8cd65691ba2f524fa89a88f1
- SHA512 eb75b9fef7f7e8896fc4f26dde66c2aabefd49031d12b6e74d8a70114ac72d5ea04294e93617702698ec447bddb97e96643d6314031a417add67fc13385c7952
- SSDEEP 96:str/d+KeGCbb9JkNbo5h16Z0Os7/x+6MhmuecJklOdjeP5K+gt28XM1C7K:stzIRionOsV+Fdkl2jkk3G6K
- TLSH T182D198026E24797B4CC7E509FB29BB03E2F5507265E12D58E7F9462C05D7BCD221790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Default\f24a5473-9280-4e35-b4fa-f2be3390a70b.tmp
- Size 6KB
- SHA256 9cd2f5b71c3d476ed790f65a0b9e43c844f62f114c3859cec87160f7d4d3b8db
- MD5 ada2ee53fb5bd06dcb0321d70af48d11
- SHA1 ad6159ba855dc95d33faf69b34190bb25eb897ed
- SHA512 6f25dc1a888f443aec1e6dcf36c345890f8061d4a979d6c8b8f4555444b3bc58bdf3c32dbae9103e15c9450dd04380452f8acd054291764f63afa7ce0d8e89c6
- SSDEEP 96:str/d+KfCbb9JkNbo5h16Z0Os7/x+6MhmuecJklOdjeP5K+gM28XM1C7K:stzIzionOsV+Fdkl2jkkOG6K
- TLSH T16ED196026E24797B4CCAE509FB29BA03E2F5507274D12D58E7F8462C05EBBCD231790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\GraphiteDawnCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Local State
- Size 15KB
- SHA256 7ad907050605ac712fbe0c5276734a2c77872a868ea00719ce3e4af9a2789402
- MD5 bd1219f8c1079b2c63e3e21ae201de14
- SHA1 24859eb58de9b2e75d3dc7352c562a7651c44f94
- SHA512 6a947627e910765f831a3ccc248313560084a91ceed80a74f6f356b4a49affbac076fe1f394249ebe801905128c489feed36fdf8d478e72054095a1d6855eb57
- SSDEEP 384:b+aQikB+z/xvxjg/qhENNBSUlhD/d4hA9zq:6/UxvxjgC+1RF4yFq
- TLSH T193729E27A5797E3799F7EA04794A0B4BDBB854B291C23EB44AEE5F0D03833981306916
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Local State
- Size 2KB
- SHA256 f36ad999c68752546bbc7f9608f143d5ecdab03ed100dd25881b1d44a7f7f51e
- MD5 dfce77355de5d41ead89c5aadf2a2fea
- SHA1 d73ae58b5ca151b637ed098a4a6c160f1a4436f1
- SHA512 347afd1c392aec0eba101fe04ca7be261c497c76a4ac548d7390f6f7486a28d901b79b55ad6f88e0947683db15466dffa055e475a2b8f605a00b984b2a801db5
- TLSH T1165195337C149B378DE68B48BD8B3F239E7550A29A523F1096DD1F1D0193B4D2316C2A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Local State
- Size 3KB
- SHA256 95f9230be9eb3e5251d468373c24b6ac453951ed7a884247eff21dbcd72e059b
- MD5 3897eb53ee0e81786a574dfb1609d0d5
- SHA1 bff8d5b8b1b5a2716e12bd0fc962420a0987fbb2
- SHA512 2afba1243a77548f53ffff7f4b874e646e53efb6ef4856b32fee8561c7def4aff56e06587bdba19b5a11295a95ebb8027e807c7289c783987a6b6dc92419fcea
- TLSH T1A36182337964AA378EE6CA04B98B3B17BAA51063E5913FA4D6EC1F0D029378C1352C16
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.fureverdock.pawsy\EBWebView\Local State~RFe593687.TMP
- Size 1KB
- SHA256 2121598b83159f0cbc68207fd6af9ee905ecfb35cc4e64a0803ea25bce7624c5
- MD5 492637680b004b128399b4a678b98ca9
- SHA1 5e2b0309be604865e2a0b4ef2d19acdb84642f96
- SHA512 16d47236baa9d0bf56c5a5e3493a6d1954d31972cd6f4dabc6789ba47ee90aa8b969a04e78b247e5719edfeada8a7b5ab8345b0cbf5e4b9439fde2c1dbde7265
- TLSH T16E21B7B3F8644B33ECC6D789758B7A1B6D6010A782411F0462DE4F1E035334DA63AD3A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_1353856894\Mu\Other
- Size 34B
- SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
- MD5 cd0395742b85e2b669eaec1d5f15b65b
- SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
- SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-bn.hyb
- Size 703B
- SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
- MD5 8961fdd3db036dd43002659a4e4a7365
- SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
- SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
- TLSH T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-mr.hyb
- Size 687B
- SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
- MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
- SHA1 d0914fb069469d47a36d339ca70164253fccf022
- SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
- TLSH T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2124_160915495\hyph-nn.hyb
- Size 141KB
- SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
- MD5 f2d8fe158d5361fc1d4b794a7255835a
- SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
- SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
- SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
- TLSH T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
- MD5 SHA1 SHA512 SSDEEP TLSH