ccec4a8ca1a36b10f5cb8e0d004eece71fdf7b4fde3be7f53f6ffd250501535c

Resubmissions

25/08/2026, 12:15

260825-pfejhs1hnd8

25/08/2026, 09:55

260825-lx88nszena7

Analysis

max time kernel
900s
max time network
843s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nex patched auth nd region working.exe
Size 37.5MB
Sample260825-pfejhs1hnd
SHA256 ccec4a8ca1a36b10f5cb8e0d004eece71fdf7b4fde3be7f53f6ffd250501535c
MD5 1bea1f4d178470b42df3bcc6c1e65d77
SHA1 60235d772828309391e5b630b4b46cb350177e4b
SHA512 f793e5098c807ab19a5976fe2f07fdbcdcbcca4289e690e1b7fde88ae598a1ab15749b344f34eb64d9ce5b46fbf43d7d3adf8b15bc82ddb5666d5e9439d111e6
SSDEEP 786432:yznxv2JLWgVodmUJAD1Y2XahpHJXduJT+KrLXtsmaPkrHEFSvCuhwm:0ndOKJAD1hXahkNgPOEFBuhw
TLSH
T1948733A693F0046EDD569137AABAC1E3D32174165320CAEF0ECD973A19BF1E61D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Loads dropped DLL 30 IoCs

pid	Process
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	nex patched auth nd region working.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1334165341\Mu\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1748686573\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1531910996\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1379822723\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1334165341\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1748686573\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1334165341\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1334165341\Sigma\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1752818452\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_61438444\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_61438444\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1748686573\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1379822723\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1379822723\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1334165341\Mu\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1334165341\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1752818452\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1334165341\Mu\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1752818452\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1633830229\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1475710832\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1919738988\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_366921552\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1493483629\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1752818452\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1748686573\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1748686573\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1748686573\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1334165341\Mu\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1752818452\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1752818452\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1633830229\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1379822723\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1633830229\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1633830229\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1334165341\Sigma\Content	msedgewebview2.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{582A373B-5116-48EA-86FC-3EC6A9B33805}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{20AFDCB6-ED10-4402-80AB-630FBC1F0C4A}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2024	msedgewebview2.exe
2024	msedgewebview2.exe
620	explorer.exe
620	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5940	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

description	pid	Process
Token: SeDebugPrivilege	2076	nex patched auth nd region working.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe
Token: SeShutdownPrivilege	620	explorer.exe
Token: SeCreatePagefilePrivilege	620	explorer.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
2832	sihost.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
2076	nex patched auth nd region working.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2076	nex patched auth nd region working.exe
2076	nex patched auth nd region working.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
2076	nex patched auth nd region working.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe
620	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1876	StartMenuExperienceHost.exe
4440	SearchHost.exe
620	explorer.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 2076	4956	nex patched auth nd region working.exe	89
PID 2076 wrote to memory of 5940	2076	nex patched auth nd region working.exe	91
PID 5940 wrote to memory of 2320	5940	msedgewebview2.exe	92
PID 5940 wrote to memory of 5944	5940	msedgewebview2.exe	93
PID 5940 wrote to memory of 5944	5940	msedgewebview2.exe	93
PID 5940 wrote to memory of 5944	5940	msedgewebview2.exe	93
PID 5940 wrote to memory of 5944	5940	msedgewebview2.exe	93
PID 5940 wrote to memory of 1424	5940	msedgewebview2.exe	94
PID 5940 wrote to memory of 3168	5940	msedgewebview2.exe	95
PID 5940 wrote to memory of 3168	5940	msedgewebview2.exe	95
PID 5940 wrote to memory of 3168	5940	msedgewebview2.exe	95
PID 5940 wrote to memory of 856	5940	msedgewebview2.exe	96
PID 5940 wrote to memory of 856	5940	msedgewebview2.exe	96
PID 5940 wrote to memory of 856	5940	msedgewebview2.exe	96
PID 5940 wrote to memory of 856	5940	msedgewebview2.exe	96
PID 5940 wrote to memory of 856	5940	msedgewebview2.exe	96
PID 5940 wrote to memory of 2336	5940	msedgewebview2.exe	100
PID 5940 wrote to memory of 2336	5940	msedgewebview2.exe	100
PID 5940 wrote to memory of 2336	5940	msedgewebview2.exe	100
PID 5940 wrote to memory of 3612	5940	msedgewebview2.exe	101
PID 5940 wrote to memory of 3612	5940	msedgewebview2.exe	101
PID 5940 wrote to memory of 3612	5940	msedgewebview2.exe	101
PID 5940 wrote to memory of 2024	5940	msedgewebview2.exe	102
PID 5940 wrote to memory of 5176	5940	msedgewebview2.exe	103
PID 5940 wrote to memory of 5176	5940	msedgewebview2.exe	103
PID 5940 wrote to memory of 5176	5940	msedgewebview2.exe	103
PID 5940 wrote to memory of 3704	5940	msedgewebview2.exe	104
PID 5940 wrote to memory of 3704	5940	msedgewebview2.exe	104
PID 5940 wrote to memory of 3704	5940	msedgewebview2.exe	104
PID 5940 wrote to memory of 6052	5940	msedgewebview2.exe	105
PID 5940 wrote to memory of 6052	5940	msedgewebview2.exe	105
PID 5940 wrote to memory of 6052	5940	msedgewebview2.exe	105
PID 5940 wrote to memory of 4180	5940	msedgewebview2.exe	106
PID 5940 wrote to memory of 4180	5940	msedgewebview2.exe	106
PID 5940 wrote to memory of 4180	5940	msedgewebview2.exe	106
PID 5940 wrote to memory of 3140	5940	msedgewebview2.exe	107
PID 5940 wrote to memory of 3140	5940	msedgewebview2.exe	107
PID 5940 wrote to memory of 3140	5940	msedgewebview2.exe	107
PID 5940 wrote to memory of 4932	5940	msedgewebview2.exe	109
PID 5940 wrote to memory of 4932	5940	msedgewebview2.exe	109
PID 5940 wrote to memory of 4932	5940	msedgewebview2.exe	109
PID 5940 wrote to memory of 3472	5940	msedgewebview2.exe	110
PID 5940 wrote to memory of 3472	5940	msedgewebview2.exe	110
PID 5940 wrote to memory of 3472	5940	msedgewebview2.exe	110
PID 2832 wrote to memory of 620	2832	sihost.exe	116
PID 5940 wrote to memory of 3312	5940	msedgewebview2.exe	123
PID 5940 wrote to memory of 3312	5940	msedgewebview2.exe	123
PID 5940 wrote to memory of 3312	5940	msedgewebview2.exe	123
PID 5940 wrote to memory of 1844	5940	msedgewebview2.exe	124
PID 5940 wrote to memory of 1844	5940	msedgewebview2.exe	124
PID 5940 wrote to memory of 1844	5940	msedgewebview2.exe	124
PID 5940 wrote to memory of 3328	5940	msedgewebview2.exe	125
PID 5940 wrote to memory of 3328	5940	msedgewebview2.exe	125
PID 5940 wrote to memory of 3328	5940	msedgewebview2.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\nex patched auth nd region working.exe
"C:\Users\Admin\AppData\Local\Temp\nex patched auth nd region working.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Users\Admin\AppData\Local\Temp\nex patched auth nd region working.exe
  "C:\Users\Admin\AppData\Local\Temp\nex patched auth nd region working.exe"
  2⤵
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="nex patched auth nd region working.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --allow-file-access-from-files --disable-features=ElasticOverscroll --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2076.5284.8385582295432880498 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:5940
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView /prefetch:4 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x180,0x184,0x188,0x15c,0x190,0x7ffe85cd5fd8,0x7ffe85cd5fe4,0x7ffe85cd5ff0
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1852 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:2 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2196 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:3 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      PID:1424
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2348 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3396 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16 /prefetch:1
      4⤵
      PID:856
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4464 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      PID:2336
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4532 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4464 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2024
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4108 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4560 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4480 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      PID:4180
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4412 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4100 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      PID:3312
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4496 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView" --webview-exe-name="nex patched auth nd region working.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4560 --field-trial-handle=1856,i,8975109095531584391,8434855819790382619,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:a371a40ac2aa6f9ea90aa9d547a6b73914b91c16
      4⤵
      PID:3328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5272

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:620

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1876

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4440

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nex-diagnostic.log

Path C:\Users\Admin\AppData\Local\Nex\nex-diagnostic.log
Size 4KB
SHA256 ceb5d4f06d399543536baa95309adfb8f15923bcdcf94572fffc60d93bfccda2
MD5 47173953eda480487c2ccacfce81b40b
SHA1 835d93a7092cdcbd91ecec8ae0ea3704f9a9ecca
SHA512 95186764c5a743036f7eac52304e67e87a1b1e818b15df797a1c93b584077374c222c704b5382313f4bdf9581c77d1802dd05fbe6017a95be0557bfd24846b28
SSDEEP 48:EytiHiIwQjEzG2RDgc5ccksqL8Auiko06nqnp:Bt2j7IgcecksqLYQRnqnp
TLSH
T16A9138AF0962611BD55CC086803BC6A158BB9A41959EC2B9E172FBD37FB741C03D8DEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\_bz2.pyd
Size 85KB
SHA256 082a761a280b08afecf6fb0509050ffbf7e87d1638ca49466b8b3eb4c85009b4
MD5 b831ff0ab5f28a1f3bae6842896d45ff
SHA1 e96c4dc15ef8f55fa47eef0f5e3d4a184eeef764
SHA512 bdac51598e349a96aa399f8d6fc6ed46b8ff797bb70b372290a941581f4b63318df9578a557a297873b827b2de2eec8cc14e3c1241cf65f3e71f5653d7b034da
SSDEEP 1536:jGNqB8z7DyEXkmNf0/ixk+x5dxNkP88l3ub8zMDIGQIS3VvcycA89JfIYhE:CNqB8zSEJUoZlTkUGK8zJGQIS3VLV
TLSH
T189838D86F36552B6F99FD1B846840793F734BB860750A3AFF148829A3F13BD06E5C225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\_cffi_backend.cp314-win_amd64.pyd
Size 177KB
SHA256 9e99b2184c60f21a88cafc374386ded3559e8694ed7cf111f2869e066d303334
MD5 af1e2f4192d2e2537f5c512e8ba6461d
SHA1 c8dc45a76689a87a1e7304e54ddead4be4ff2e0f
SHA512 c0e70a0e2574f6c0d2943386a99f993f872051f2984292f2658324da180f410c4d4d498abacf7b314b1df176c06925a55da2c712c79f709a0ce9d70e2c122af5
SSDEEP 3072:obPkCwSdqHZbgEfoPfex6CXfWstgU9B42c3LN7wkuiuAMAP7OBSTLEKdmF+jSA0M:ogN0EfoPferestgU9BVc3LN7ZmVASBSJ
TLSH
T1AF045C5A329C11B2D5A64178CA579B83E3B3B460175097CF0160C7B62F1FBE67A7BB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\_ctypes.pyd
Size 139KB
SHA256 a11d680d89f054584e6a5b2a03103d8731def86e367aff2f70cce8c6367f9025
MD5 208e7dd066f23080da03b4ebd20fbc43
SHA1 8b56760b26be7c98a6752cacb3e78716972089ba
SHA512 7841d4a3d6b04d00eff9e6a7ebdffea6d5a257bc095bfdfe33ffe78f2d0ce731af5021206b8e3b2e0da5ab0a27b0a65d149c346ea6c1d95fdd75087a411de40f
SSDEEP 3072:7Eyf/PRau5nIktyc7utl1OUIVi0I1sDdMIBU8ISGPiT:oy35aynVp0qUITGs7BUS
TLSH
T146D37E0B736440E6DAA78178C6739E57EBB1F0511A1087CF4264C9AB2F633A26E3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\_hashlib.pyd
Size 67KB
SHA256 0c11671a2c572b4c016be263789f238125419df5711e281acdce8da50d9badda
MD5 4f7f664e8558a6cfc93ede2ae9d6974a
SHA1 0b5ed2b9c68120d5912f12c1d6038afe517547a1
SHA512 89cc41406f4b3da7ea46e15e12f86135ffe8c3fa2d906c8aa370402cfa4bd67fa00e2901e33e3e44daed075ddb9ac35c4dfd3181c44544d17c97522363227b85
SSDEEP 1536:aL0SOWZsPqJWvnKt6RfoISDI1ycA89tfIYke:ULYyJWvnKt6NoISDIYM
TLSH
T1A2636B4AA6984062DA2382B4C8E34F43FA74F652271197DF6779C18D2F233C3537A756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\_lzma.pyd
Size 157KB
SHA256 2376cd374ce8c2c5ecf573226e563a96975599533f86a5f5eba5bdb705e341bb
MD5 d412fca808a8dd9178ccf8bd9517859b
SHA1 6088ee0ee94f6a245bac0a0d1c0e664ca630cc07
SHA512 35afe64a19ff6737b662b9359e591bbb00c169e83609dff1c2ab1fac829316200b8a121d1bedb28bef832e7968a95e01986d20f8cb0d511e7b0d794010484e8d
SSDEEP 3072:M0m6DHDbBwiZfxA/VcNBznfx9mNoX3mfnbOQISI1jmT:MTCHDjfDNJpYOGfbO3+
TLSH
T1E8F35C86B394F0E6F7228C38D6614F57E7F5791A0320929A01CC976D2B1FB659A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\_queue.pyd
Size 35KB
SHA256 8e75c8667f938c3e9b2e9739c09b08517b487437757f125ac400c70c7eadf270
MD5 da5725ad6e85ce51c26e6b166a42e4a0
SHA1 11c7a9e2ad7c88eda5546ebde644d0d4dd748132
SHA512 bd1a145368309230c4898d6d0815b17fcbb0b7ddeed8e6b76ebb8e9d9faf76bdcfd7d2f5fa39ea12ecb82ae474d5277447bc472ecf0baff911951f86cb5d28a3
SSDEEP 768:C6KN6rbeVOX8ISRURnxycTOJh2Ip4iz2Txf1mlRaXUCWP:RbeVOX8ISRURxycA89iyfIYUz
TLSH
T157F27D89AA585197EA63C970C1A6EFC2F934F7D3470187DF2179C18A1F233C1A73A259
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\_socket.pyd
Size 85KB
SHA256 42b84410269af5a5578679a3fe7b17d75d28f77a0c3c09d589adadd9d2d3e5f6
MD5 b8732b29606a0d93be25bcd924b50239
SHA1 e7270350e71ce191d5fac5e4a6e5e7be0d0bd1d3
SHA512 489a3c09eb6665b6ee9b460303ac35f1228684723fabe34bb29c5de7b2b12d3fa8853e1eec8b8ba3eb3e80c517cdf1a263e6b963d4e0d2d092c52567a2ccca4d
SSDEEP 1536:QcVunc70XTxn1egypx97XP+N6wSz9GN7WQRcSqIP4fY8ISGwyycA89gfIbHqv:FEna2Dypx97XPs6wSz9+WQyS6fY8ISG7
TLSH
T109834A00AA6040F6EB76C176C6639E63FB74F5C112D4A75F1466C65A1F33382BE3AB84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\_ssl.pyd
Size 180KB
SHA256 bc17486f149f7311839c70b1cda5a22e4546a9670d3136d665df95ff3cc43abd
MD5 6252eee501b79b472903a978872518c3
SHA1 dee9a3ab7444ae6ff203d585ed5b18f2af4b508b
SHA512 752947bce9d8177cb93100911a3c4fb74aa86c72f5b7f4b733636673459fe22f30812e9cfd34d7ee29e34e4ccef37b20559fd05b3f371be1f5d2ba89b64aac09
SSDEEP 3072:6QjyHsqUEao3kfF6Cu3qMX31Wzy4zXClit8aN4Qp8VuMG4eJ9i1zktdsQ/3/UpnA:SJUEV3QF6Cu538zyAUBzbT0
TLSH
T1C5048C47B1846AF7E913E4F9C6234543EBB4F145332297DE48C6DA860F03346AE66B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\_uuid.pyd
Size 27KB
SHA256 d75d04aa989f8be9666505ac11339416719e38fc0701047388b061b4e576030a
MD5 b166cfb4f4a913ed861dbe9fb93ab388
SHA1 5e21441f6a75347c887cfac5613aa4dc102ce385
SHA512 b290c7b4dff5daba842979439c53f495740ced0555e59ffeeafcfe9063d202cf8f5ae658adb146b94f6113e4b7305f3200d2cf357fa1ba65696b08f1ff38d4ff
SSDEEP 768:eYV25cQISIw0xycTOJh2Ip4kzTxf1mlRaXaCK:eYV25cQISIwMycA89kRfIYab
TLSH
T1D6D26D8A9A744053FE639770D1F6DF82F939F7D34A1146AB316991860E133C1B32B2AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\_wmi.pyd
Size 39KB
SHA256 a299a6caf7241cebb0081c3ed9e98f815c61feee3e4813c1fd32369bd3fe6f5e
MD5 72a4dfa925a2b6326a005601dcc4cb34
SHA1 645d36a951c9f7c9ef7cf797ed600b25c04a82b1
SHA512 46b7adc94db1ccd8773e3247a0d661784202c7ce05edbcf3a616376e011543a243c21eac776f1a07179a1f491efc23ced854fa68e7d700863463cfd2e947777a
SSDEEP 768:q2/EEqrVmjstuQsQ9VVQIS3izxycTOJh2Ip4YTxf1ml9dHRjLJ:vE9BEbQsQ9VVQIS3iFycA89kfIbHRv
TLSH
T1E1038D89E6640092FA6BCA74C1A5CE93F575F7935712838F326582590F333D1E73A329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\_zstd.pyd
Size 491KB
SHA256 8f04a54778d4f21202f1bb9cfd5d080c5c5022158016dcaaf5908f7e2350270c
MD5 225e0462bf8337155e78b36e3cf9fa79
SHA1 ae944f73defa8ac5ddb3069fbb4a9da5ecafef2c
SHA512 815201438564f8c9d57b0b8974d4b82d10bcd313e41277d85f290c0a3a94b9be8d31b5436da8704cb342f19fe68d258ee026642eca969bbb6518acd79ddb05b5
SSDEEP 12288:MPm5BlLPg/FcxTbwWo2iD4xjnsTrWl93W6Ct0:MPm5BNg/FcxTUWo2i0x7C0
TLSH
T1FAB49D43F29943EDE17BC4B8CF465A53FBB1780B1214564B93A5CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\base_library.zip
Size 1.3MB
SHA256 5241d2567e277a34c9934162e6095af0ce38efe0d8a30c3425131d62883abe0d
MD5 3c2315c81fcb70f30486113bad24637e
SHA1 4f792a6fcc24e6b07d1b27730b827c648275f54f
SHA512 8e6628990f4cdb1371afda3682b50ce28eb3d9647f0238ec97cb1604c71cf60e552fc5abc4de0bf0159417f871e15526d398be103c7bf6b290db2574a1c8dfc2
SSDEEP 24576:UuUFVdwurlb2x3RpDrDJQeOdP2m2df7LJW:UuUFVdwuqR9J/I
TLSH
T1B8552AA1B9917967FEC9F37A35775A0CA715C0109B20D303B4A88DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClrLoader.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\clr_loader\ffi\dlls\amd64\ClrLoader.dll
Size 10KB
SHA256 07f62bcb1b70320f221ffb2cfc5ce6133815195f3e7cdb8d833222506188c2ac
MD5 b1e06e1d60d22eb8f4a8b4661e58e107
SHA1 9b2fc59c4ff38f3477ce8ab32d9cd7440371d60d
SHA512 d9d157c5bde635d8eb0d434ecdc642aee81b0e759ec2b894de901bfba545337cc85e8ce65e362fc254fc3fc45cd19b6243f2742a5a42e64cf26d2ec415deb9e6
SSDEEP 192:KeWJ4MX8pNfn9KE+8OLsNfsK8RTUWT8L:zSX8pBgX8AsCTy
TLSH
T1DD222A06ABF8C31AE4BF4F3AE873520853B4F6255853DB5F4CCCA04D9C127485AA07BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\libcrypto-3.dll
Size 5.0MB
SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
MD5 8e8f32ae40518478e44269cf22cf4399
SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
TLSH
T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\libssl-3.dll
Size 776KB
SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
MD5 f31ed8154564b75e48f2525a7e9f5742
SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
TLSH
T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\python3.DLL
Size 72KB
SHA256 28a395fb2bda5e71084478abea00da9ab1c1dfeb7c4856c258518bee9cc146f1
MD5 3740e03e444c539461fedcf191758226
SHA1 64499ea6294ed68e616d1ec25ed4892cd3740741
SHA512 4a6e748f1619b59a281e80231f3bf1316330fe058b3860fe5902cd7021795f18a7d716a9a3490414bf637a1edcd77e71d67fb7ccefd7935a19f64d12a0da00d1
SSDEEP 768:hQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIw:MbTrnXngXMT8ISG03ycA891fIbHqv
TLSH
T17E734D5D6B54F8A2DAF629FC78D199CE242B12FC4F2984DFA47DD3920D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\python314.DLL
Size 6.4MB
SHA256 7ffe3ab11342db03cc18b026f27485c0f74f5bf10f239f1f6573394900596394
MD5 23b7bec4bb8cf109503029b50f5eadd5
SHA1 a5cb46bedfe2be49ae75bf0a95ab646c3256aee7
SHA512 d687ea3c15b7fdd08ecc29e73e5310195483bae18c7b49895b0b855b0df13b0b6955d75022f842725b17e3b2ef9e922d4eb90e8819f2c8be84890d7ee49a92a3
SSDEEP 98304:ctcc7EmUp55MA3l5vHi+LPL4G8hvGHDMiESkYD:cWc7EmUp55MMPHi9NikYD
TLSH
T1DC669E26737501A4D8BB8035C9074687DBB1BC04AB30D34B49A4B6DA3F773635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Python.Runtime.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\pythonnet\runtime\Python.Runtime.dll
Size 435KB
SHA256 648e6b415be8f45018af71f377aa3a97772799b353ac3a5e8612a99313de4907
MD5 edf72c42a4f3844f079fa1ff0d597c00
SHA1 0377ea493aa17a11ce19a9e43b289c69dfe29bdf
SHA512 e61db09828161f22b2c3f2e23ef1e8db3179619559f35486e163d31cd4a900efd37c873e8100ae9f11e6c1a6e8d42d07809704681008c762e1254ed08d609d59
SSDEEP 12288:ZvpWAHM8dtycsmH8PLUppD6qs5PxxAXlh:KACIppGqQxA
TLSH
T19A942B6163E8CA6FE5FD267490341C774AF3F4436462D79EAA98E8D62D127814C02BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\select.pyd
Size 32KB
SHA256 a0f7b2e00144794e497d11fffc14e7a968f59e207c702ca7b262b7037065b5ba
MD5 6b181cf903a5903f9d8d711a731578d3
SHA1 0f2958ec2e4beb41dfedc912a6c635aeccddeba3
SHA512 c45f0f99bbbfc3d84a5e5782deb4440f6033e46e169209b60cbaf97ccd3c57baa5ee480aaf5239c75e0f2821c66d72a7ad973adcb69ee5666e5e145bd36e3920
SSDEEP 768:UB7YgHfWVHrF8ISRGqxycTOJh2Ip4JTxf1mlIJGp2:UB71/WVHrF8ISRGCycA897fIkGY
TLSH
T126E27DCA6B745047E9A2C631C5A2DF83F939B7A35721868F31B5919A0E233C1B336358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Lorem ipsum.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
Size 1KB
SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
MD5 4ce7501f6608f6ce4011d627979e1ae4
SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
TLSH
T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
MD5 SHA1 SHA512 TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\ucrtbase.dll
Size 1.3MB
SHA256 d404dc9aa843d53d7e276dd078b2cac8d7aa905e2838a1fe8385278e19ba3810
MD5 1c5c8447d570e0eceefc9f3f92c008da
SHA1 a198c2897e6a1c5745e2ef7f508541dc21675ad4
SHA512 a1dd080b57a6339cbc66c9abaecc0a59315b9dfe843176267b10a8324b8eb15e0f2c856c7de938d3405905dadc36d75f0ad3ad67d8aff5caa42ceda889c07607
SSDEEP 24576:XUanuON+jflUtGz/rLeX+NNF7R8b1h9X2kwlNsmGb6mxvSZX0ypympKF:EIuON+jfl+Gz/rLeXDdXGQepo
TLSH
T16055AE6676AD01E9C1BFD138C65B4506E9B2781503708BDB03E94E7A2E3BBE5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\unicodedata.pyd
Size 740KB
SHA256 64844c24f67e7eafb77142b4cbe4a430f4db3b16f59191586ba6596ca19fc775
MD5 d421eab157a93fd255554dc2d31b7a3a
SHA1 f6f8a395fe2f805299867022d1c8067eae636ea2
SHA512 9158db1315582cbc076e13360d764576f25f666996af07c377fff6170699f181702cb6e213f7d169a19fcc31a0dde9d4f19dd10038434c1a4cea4bb72a0a4b1d
SSDEEP 12288:lY0APtrZmDtBPcH+dEYJ5EAub+z70lDJPT36mwtW0N:lYx5ZmDPqO5ElDJPTMWo
TLSH
T15CF4E4F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api.js

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\webview\js\api.js
Size 8KB
SHA256 cb68b8bed427fa356aea26376e497552f55d91329c093c026a65230d074e2b27
MD5 1c3d5c8624b15391910ce925fc57cfba
SHA1 5ee44865c258edf3c6f158c396fecc98555c279f
SHA512 00c1f8bccb4f88fd664d65b44b17f8203179e9af166d23bc69f6cc98fe10c4bb681c76dd070264aa1c2096b97a7517b59882a889b71a26a1b5dfc7c267c1838d
SSDEEP 192:dFT4u0JkIWY4UWIscqoPZfKOMQYWuiRglTpkvYQQP619Q2NTJ4Ro8yh6HwUeS32S:dFTb0r4DIscdc+Ra613Woj6HwUeS32ds
TLSH
T16C02105C6AF340695E6375B94BAF300AB53860133408EE90BD8CDAA05F95D1D93B9BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

customize.js

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\webview\js\customize.js
Size 4KB
SHA256 ed14d0b594266dfe3834cc8565b44a8157420432aeef4f733ab505bd6ed89b8a
MD5 a63dbd8ed7b972cb3df70eae12506d30
SHA1 33742172960e93a7f09a563076bde47222fcc18e
SHA512 905efe268af51374038f21266003274779fd967aa7ea1c977225ff42807095dd10039987c735e83a86cd2f057b13408274cdddc9f3d6ec741feee500b87469c9
SSDEEP 96:kG1HDhNsCDJh9DcDHsxDdgwqoj26EvsK3zuEOCihLJYy4U8/L4:kG9NbNno8Zzq48sauEPihLJYHUcL4
TLSH
T1C8911E0952E75879963BF67A6BEF7205B1324057140AEE24BE0CCB85AF60C378361BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

finish.js

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\webview\js\finish.js
Size 357B
SHA256 751443083dd1d2b2ef4142692f25bc4f6e04f8de4d82c455c73473700f00c8cb
MD5 6e675984a2dbe8f8a760b026ca90c297
SHA1 82a8829bd3febcd5574c902cf3c8f918cf6ab8a9
SHA512 2ef7554fb953b54a383d73f863f62f9d1c716895fec177e75d94609a6b7153c926d47b5e1ca98f3da69eee8b62c62d2faad8fdc295253f89f32579dca4382354
TLSH
T153E0D8E4D0B21140443634B36BC73F07A50AB69170144799F08DD244EBBF013CB0D5E4
MD5 SHA1 SHA512 TLSH

Submit Download

polyfill.js

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\webview\js\lib\polyfill.js
Size 26KB
SHA256 481a08f5337a770acf49b38c2f58dd0c95f92bf9dbd92bf82b596836ea343ab5
MD5 1a39f00d8ed373bd66c0959fb2d98faf
SHA1 f138776ab27782eb742d4f4a8c15bf9cda71e5e2
SHA512 f9f6cba84c8011940ddc5938b4da4dcf58479310ec43dce7ecc79383efbab22865739255515bf9d666be39f97402bb901c4394beaf25509494c509cc6ef4e28e
SSDEEP 768:f6Hhlllw46v/uKB89De7p/ghK33He4Q5yErM3QXKx7gbGSlGFekKJMPLnR7ogeHC:fubVKBSKn+0gaJCtaUvzO5m+KbY
TLSH
T18CC27788F7BCB4B6812A3164841F50CF913C8473C89C68FABD9D98E819E556D439AF3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

state.js

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\webview\js\state.js
Size 1KB
SHA256 68ee87ec01563cbcab77a57704a32f19b47436c9d5e254bfba9675a51c132075
MD5 72b09eaa481e7d0d67c831b98f51944b
SHA1 2a26049994ea50c399b62f5d269d619a45b4baa9
SHA512 dd02a3ac70e209359e9cf973f6126cf8d5393e33611cbff8353e86a2735c6a7b17ffa39af18de0123d2e95d57424618803450cc9553dfbc4fcb060b3947b6090
TLSH
T162318B49BED3D0D48922B17E0FDF3104E93C68837A399B98BD0DE240AF905246BDD9A4
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Web.WebView2.Core.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\webview\lib\Microsoft.Web.WebView2.Core.dll
Size 634KB
SHA256 8219a3135436c147f8eb02fb831e99596103eebc18b6d7b794ca93f4c67018a2
MD5 31ee8843e003dc6d0d74087b031a97db
SHA1 825ccdc2fc681a5eb7308e509102270d894cab2c
SHA512 6ba5910c6e1ca0124ec597fc6b64c858c260663ea4bd50552dd6df43e3198a5e75a2f1df972fddf732857292b66dc6f2fd874f966587e611c01fe11244d0114a
SSDEEP 12288:qBfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4xrpsRerP322z:WQcl4tOu
TLSH
T10FD4522223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.WinForms.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\webview\lib\Microsoft.Web.WebView2.WinForms.dll
Size 38KB
SHA256 c48f8d729dc531288d2c53a6241effe7922ed1b947850b2442008a945c098c48
MD5 54a235d901c82a5a90561479da5deb13
SHA1 c2aa04d40c69b73d5934a323aa945ad4f96dcefb
SHA512 9216ff976a6d952c74548f41d2ee5335411b3780e85e650397edc2f33c84011fc5c4bb69742226897bd2d5139abfae676dc944ee0110887cbbab2848b38ccc28
SSDEEP 768:tbQNb2vIYymJ22Mss+5pQ+ZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQSxS:tYb2vLbpQ+ZDgcEST3p4JjrjaeFSUyaO
TLSH
T19E033C4087ECC517E6EB1F78A5B491610BBABEC33DA2D7A80D84B1DA0C73B9055143BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI0000135c2\webview\lib\runtimes\win-x64\native\WebView2Loader.dll
Size 158KB
SHA256 eb5335edeaa6f2122c044e82aab2351dc8c9b4e0fe5e578c71922fb61be285e7
MD5 f09ce21c12a06edd3385f0e8fd082957
SHA1 7d43a6e0a27efc8a44794b8745bf157ed78cfd96
SHA512 98739a40e5268ff0428c5c288bebe1c095ba791c4c8b0e9c47325be06b81a1d4d7f1edc934d9960247b8c2888371183ec1ac49b743ae917761ad399d03504d33
SSDEEP 3072:WuGFLiM0PqJexS2Zk7mNzoJqD3a1pGArTTNEtJ9msIjm8pstP:WufM0QO5nNzoJqbyEtJufA
TLSH
T1D3F35B57B3E900BBE177C278C5634A45E772B85117509AEF03A4427A1F23BD0AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8250affb7130b53fc5b7d2ff27800244afe52a6a31059e3f77dda07fd4733990
MD5 5f7693ad50c5fd2658df1bccf23184fc
SHA1 106c1763096447c29118cbb025221c56aab0f916
SHA512 43b8b6819e01e0b7f597682f5faacee0e8cd0cdb534175995fab7484fceb0122c601b956cb81fa498a2ff852d7a1b2f677d2db1f61d4cfe985e700e9df400a80
TLSH
T112D0045473014004C011373510D3410507C0470140534345041154D455C0033101D0DC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6878255660877583d6b2e6eb0ab0677f23dc5e2877d753d8014413e2a65d646b
MD5 2bf99d5bb37c9959a8da2cd377ad969f
SHA1 f5310e2fa0033b92f543b00248660c6fcb24fac0
SHA512 82677922c3f4d7de6ca318e406dad2903318a879a9a52c5f8eefd92542d2e23ff31fad3e0a9e2db9295ae6321ede3f4c18a1b5e14c25369801991bc6349c14ca
TLSH
T1B2D0121633024138C02036331083610D0980C30B804681455829D9AD6B44071191A4D5
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

384be602-fb2f-4bd3-9eb8-536f268d9748.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView\Default\384be602-fb2f-4bd3-9eb8-536f268d9748.tmp
Size 4KB
SHA256 a2dbf0f95a28ce0a575ba6f584586c945364a867fc90eb96d1c978034021535c
MD5 06fc63e667113e988951fcea8b606f6f
SHA1 57201d6482a0c4c873672681d17df08120f96188
SHA512 e56b57bdb8ef96a60459ac513869d791f22f95684dc35c246b6e21b2fd6025f75be99754dda3934ea8d35fa011759db15afbc79ad9cbe8fe900086fda4530eaa
SSDEEP 96:stY5WIAFLp35h16ZZs7/x+6MhmuecmjenK+gz28XMZCB:stYsvF3+sV+Fijp1G8
TLSH
T10BA1A7026E247D7B4CC7E159BE367F53E2F5207235D41A98EBF8865C08AA6DC231780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ac025.TMP

Path C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView\Default\Network\Network Persistent State~RFe5ac025.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

e0296f6d-53e3-4e44-ba1c-2df855f66999.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView\Default\Network\e0296f6d-53e3-4e44-ba1c-2df855f66999.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView\Default\Preferences
Size 5KB
SHA256 110861eb332138fd9941bc51239e19ecfea64b5280e625daf4fe16455d0bf0b3
MD5 a9b6e3e9c7ba7c34bef14915a9af5481
SHA1 1908cf1daa86774cdc39f670777a0b1aab84ca92
SHA512 e551cbe54dd514c186d700b75f66552423d5e2cddad562b793da414ad4b031ac38f053c7750e195c58304d81970fde1aa3b16e07af47a16a1a3222e3dd11024f
SSDEEP 96:stY5WIHGFLp35h16ZZs7/x+6MhmuecmjenK+gr28XMZCB:stYsVF3+sV+Fijp9G8
TLSH
T172B197026E247D7B8CC7E119BE367F53E2F5206235D41E88EBFC865C08AA5DC121780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView\Local State
Size 15KB
SHA256 f61a8f40e2b49f706d43e12a5c3fa06d3dfc69b6a46e01ece9770cac2d1ac4e2
MD5 7a11335cbfa9d05e51a81cf69447713b
SHA1 cc8798b38d44e7ef60466ca7b14ce05b408432aa
SHA512 0be22581e57e1c36dd6bafef92a21bae54eb98c5c79af9ae8b16afa0cbaac65c3df6d75e044d8cda5528b60110abe0928952318a16687b54ba245ef6ec05328c
SSDEEP 384:5+aQikB+z/xvxjg/qhEwNBS/yC/gtVd4i1dM9zE:k/UxvxjgC+XygGz4i0FE
TLSH
T1C572AE2B95787E3395F7E6057E0D079FDBB998B291817DB84AFD6F0D06972880302816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView\Local State
Size 2KB
SHA256 fc20a0ada744d5dd665a15a3479d07c3045d6a95add4122ef5949575e64ab0ae
MD5 3064265fa68f5c36763211e1e84efb74
SHA1 7c7cb647ba518ecde231acf91b3cdf5f9fc7a295
SHA512 294cbac9d3032af7694aef1bc8405ca54c9dfb897ac503c0cbcc4c8ea9cb296480bff61490fd0a6393b723872b08219ec67ceaef68ad4bd346a35bf401ad02a0
TLSH
T1D4519433B824AA37CAF38748BE4B7B63DA7550629A526F5096FC0B0800D715D23068BB
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView\Local State
Size 3KB
SHA256 41334ebba3923095f2cd06e148bc25fdf0868f082c954858b9cda3d5e0b51125
MD5 3d031824720f6768f34a920211f51a0d
SHA1 5578debf475468fc06969f654259440649c154ff
SHA512 5cf64af924de762ee340a497ed90f1a349031d6966d053121a1b528e15d305346ad68e561c302d97892674b67da7df306a851f3b645b3b535078abd330972c70
TLSH
T1C4615136A964A9378EF3DA05BD8A3B17A7B55023D5817F94C6FC0E0C01D728C1342867
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5998db.TMP

Path C:\Users\Admin\AppData\Local\Temp\tmp_snc8zmb\EBWebView\Local State~RFe5998db.TMP
Size 1KB
SHA256 a398b1c85201f7d70f1f84dfda2ccc03e05bf76164a3da0f361986f7782ac8ee
MD5 b16f516f38777c3df2b81d6c75832bb3
SHA1 7a9d77d143fca6e751136dc1acb061df7ff667d6
SHA512 06dca096b7cdfb25d80907eaaf95cd0c8fc211d8b62380815624f84de50d128f1ea3158aefca69f318bef3f5c93eb3e379fa134f36f438dd1cb958f1470a9902
TLSH
T156219872F4249B73EDD2D346660B7B6B9E71102743008F0092FD0F1801D618DE62A876
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1284676470\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5940_1334165341\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

memory/620-1423-0x0000000009340000-0x000000000950A000-memory.dmp

Download

memory/856-453-0x00007FFEADF10000-0x00007FFEADF11000-memory.dmp

Download

memory/1844-1504-0x0000020116770000-0x0000020116771000-memory.dmp

Download

memory/1844-1524-0x0000020112FD0000-0x0000020112FFA000-memory.dmp

Download

memory/2024-877-0x0000018317D90000-0x0000018317D91000-memory.dmp

Download

memory/2024-870-0x0000018317D90000-0x0000018317D91000-memory.dmp

Download

memory/2024-876-0x0000018317D90000-0x0000018317D91000-memory.dmp

Download

memory/2024-880-0x0000018317D90000-0x0000018317D91000-memory.dmp

Download

memory/2024-881-0x0000018317D90000-0x0000018317D91000-memory.dmp

Download

memory/2024-879-0x0000018317D90000-0x0000018317D91000-memory.dmp

Download

memory/2024-878-0x0000018317D90000-0x0000018317D91000-memory.dmp

Download

memory/2024-872-0x0000018317D90000-0x0000018317D91000-memory.dmp

Download

memory/2076-523-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2076-334-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2076-336-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2076-346-0x00000232F2600000-0x00000232F2608000-memory.dmp

Download

memory/2076-345-0x00000232F2600000-0x00000232F2608000-memory.dmp

Download

memory/2076-343-0x00000232F3500000-0x00000232F3ABA000-memory.dmp

Download

memory/2076-503-0x00000232F45E0000-0x00000232F47AA000-memory.dmp

Download

memory/2076-505-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2076-515-0x00000232F2630000-0x00000232F2640000-memory.dmp

Download

memory/2076-516-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2076-522-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2076-356-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2076-524-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2076-342-0x00000232F2F10000-0x00000232F2F32000-memory.dmp

Download

memory/2076-544-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2076-341-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2076-340-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2076-339-0x00000232F2610000-0x00000232F2618000-memory.dmp

Download

memory/2076-325-0x00000232F2630000-0x00000232F2640000-memory.dmp

Download

memory/2076-330-0x00007FFE8A50F000-0x00007FFE8A510000-memory.dmp

Download

memory/2076-329-0x00007FFE9E130000-0x00007FFE9E13A000-memory.dmp

Download

memory/2076-328-0x00000232F2510000-0x00000232F251A000-memory.dmp

Download

memory/2076-338-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2076-337-0x00000232F25C0000-0x00000232F25C8000-memory.dmp

Download

memory/2076-335-0x00000232F25B0000-0x00000232F25B8000-memory.dmp

Download

memory/2076-332-0x00000232F2E10000-0x00000232F2E84000-memory.dmp

Download

memory/2076-350-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2076-333-0x00000232F25E0000-0x00000232F25FA000-memory.dmp

Download

memory/2076-349-0x00000232F2FF0000-0x00000232F3092000-memory.dmp

Download

memory/2076-353-0x00000232F2600000-0x00000232F260E000-memory.dmp

Download

memory/2076-351-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2076-355-0x00000232F2F40000-0x00000232F2F48000-memory.dmp

Download

memory/2076-344-0x00000232F2600000-0x00000232F2608000-memory.dmp

Download

memory/2076-348-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2076-357-0x00007FFE8A380000-0x00007FFE8AD24000-memory.dmp

Download

memory/2336-615-0x00007FFEAE340000-0x00007FFEAE341000-memory.dmp

Download

memory/2336-661-0x0000023692E70000-0x0000023692E9A000-memory.dmp

Download

memory/2336-616-0x0000023692EA0000-0x0000023692EA1000-memory.dmp

Download

memory/3140-1099-0x000001EB99DF0000-0x000001EB99DF1000-memory.dmp

Download

memory/3140-1110-0x000001EB99DC0000-0x000001EB99DEA000-memory.dmp

Download

memory/3312-1449-0x0000014440E30000-0x0000014440E31000-memory.dmp

Download

memory/3312-1460-0x0000014440E00000-0x0000014440E2A000-memory.dmp

Download

memory/3328-1644-0x000001E55DDD0000-0x000001E55DDFA000-memory.dmp

Download

memory/3328-1570-0x000001E55DE00000-0x000001E55DE01000-memory.dmp

Download

memory/3472-1218-0x00000178B6A70000-0x00000178B6A9A000-memory.dmp

Download

memory/3472-1210-0x00000178B6AA0000-0x00000178B6AA1000-memory.dmp

Download

memory/3612-854-0x0000022343FD0000-0x0000022343FFA000-memory.dmp

Download

memory/3612-687-0x0000022347D70000-0x0000022347D71000-memory.dmp

Download

memory/3704-937-0x0000017782CF0000-0x0000017782CF1000-memory.dmp

Download

memory/3704-954-0x0000017782CC0000-0x0000017782CEA000-memory.dmp

Download

memory/4180-1065-0x000002212BB70000-0x000002212BB9A000-memory.dmp

Download

memory/4180-1051-0x000002212BBA0000-0x000002212BBA1000-memory.dmp

Download

memory/4440-1253-0x000001C9001E0000-0x000001C9002E0000-memory.dmp

Download

memory/4440-1252-0x000001C9001E0000-0x000001C9002E0000-memory.dmp

Download

memory/4440-1298-0x000001C913210000-0x000001C913230000-memory.dmp

Download

memory/4440-1284-0x000001C902E10000-0x000001C902E30000-memory.dmp

Download

memory/4440-1260-0x000001C902A30000-0x000001C902A50000-memory.dmp

Download

memory/4440-1254-0x000001C9001E0000-0x000001C9002E0000-memory.dmp

Download

memory/4440-1261-0x000001C902F00000-0x000001C903000000-memory.dmp

Download

memory/4932-1154-0x0000017734D20000-0x0000017734D21000-memory.dmp

Download

memory/4932-1171-0x0000017734CF0000-0x0000017734D1A000-memory.dmp

Download

memory/5176-900-0x000001AC02CF0000-0x000001AC02CF1000-memory.dmp

Download

memory/5176-911-0x000001AC02CC0000-0x000001AC02CEA000-memory.dmp

Download

memory/5944-388-0x00007FFEADF10000-0x00007FFEADF11000-memory.dmp

Download

memory/6052-1020-0x000002052D0E0000-0x000002052D10A000-memory.dmp

Download

memory/6052-985-0x000002052D110000-0x000002052D111000-memory.dmp

Download