hxxp://google[.]com

Analysis

user interaction
yes
max time kernel
100s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample260825-trm29assht

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
119	5064	powershell.exe
121	5064	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2372	powershell.exe
3940	powershell.exe
5500	powershell.exe
4172	powershell.exe
5920	powershell.exe
4584	powershell.exe
5988	powershell.exe
5540	powershell.exe
2504	powershell.exe

Launches sc.exe 37 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3908	sc.exe
4524	sc.exe
5060	sc.exe
864	sc.exe
3416	sc.exe
864	sc.exe
2728	sc.exe
2848	sc.exe
1392	sc.exe
1476	sc.exe
3788	sc.exe
1476	sc.exe
3144	sc.exe
3836	sc.exe
2372	sc.exe
1496	sc.exe
2480	sc.exe
3932	sc.exe
4172	sc.exe
2372	sc.exe
3948	sc.exe
4788	sc.exe
3892	sc.exe
1536	sc.exe
4548	sc.exe
2096	sc.exe
4676	sc.exe
3908	sc.exe
4524	sc.exe
3932	sc.exe
3860	sc.exe
4188	sc.exe
4620	sc.exe
560	sc.exe
4172	sc.exe
780	sc.exe
3448	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 37 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4740	cmd.exe
4616	cmd.exe
4712	cmd.exe
3080	cmd.exe
4296	cmd.exe
5420	cmd.exe
5740	cmd.exe
924	cmd.exe
1952	cmd.exe
1824	cmd.exe
5492	cmd.exe
6116	cmd.exe
4272	cmd.exe
2096	cmd.exe
864	cmd.exe
4756	cmd.exe
760	cmd.exe
4372	cmd.exe
5188	cmd.exe
5548	cmd.exe
5612	cmd.exe
4860	cmd.exe
5060	cmd.exe
5060	cmd.exe
4148	cmd.exe
1476	cmd.exe
3376	cmd.exe
4176	cmd.exe
644	cmd.exe
3516	cmd.exe
2512	cmd.exe
440	cmd.exe
4716	cmd.exe
4692	cmd.exe
3948	cmd.exe
5640	cmd.exe
2068	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2512	cmd.exe
1856	PING.EXE
1824	cmd.exe
1296	PING.EXE
4296	cmd.exe
4148	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3208	msedge.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	Clipup.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000139c23cd03211c47afdce08e2bfc652a00000000020000000000106600000001000020000000a005c51913f24758ad77697916267cc5cd7003e73a6d6814cca7171006b49e14000000000e80000000020000200000005ac414e62b38973460f2bfd66fc0971aac9d4a14af85c14209b575391040ffe9700f0000d649e9943fb14b504c9adf2e871a5e1f9258b8603f8e05c64705e5e861e5705b104e957bd50d87f4f2063c2cca1a98e4fc8abc6dc1a5452820eca2f3116c0b578368d1d7614dfe756e7206bc714e32062deba772207c4099571328706658632f7847090fee1d0e7069e8b81ba01c9a57958c01e541c817f76e6d5fabd2de4a98c1cff602bd11cb791066f552604f4d2305d26fdf4f86d5df433e71aa992b161335e776a35196c93005fc64ec4b2a6a7e213182a97286b0d5c4f231914077a5750dff0f8320ee4e94a140ca5fbd3558b55b6da97dd5e54caecbd6971ada289139f9906735e5f52e9175c0bd2c32e0273f04b312c7eb64d157f63e52c93d18e62270a7bc0a7bfa3c372472da19a049f4b7ec6baa88931f3f07b7a03af1e6195277aad5efd95c097a9fb195c18623dce2370cb84df13ebbd5d565ec00651b4cc7ea78985d54ffde82d3f938221d39c30e1e951d191069e814991423bacabe1d1f225cebb763f5de046195d233af3b36c2c75357d31065e62aeaa5fb78108ebf27215ec4b97f1420426f2ecfaa515b20a5208e604f75be594a34aba5d36acdeaa6171d7570226b1d837ffde6c4a027ae6f9f98fa015fbb57aa6466400b1b68a49e12a58b4cefc38888c2a5d712855cfd55c59db6366a83d32264fcff560862aca4f604497b92f3553d9ae2b229a9f72351f46bfd01a7e018102516b61d860ab8690d9ac6c1b7b220fb0a1bf33ca568eaceb334de41151d862fa2abf53f52728541adfed4ebb27497107283506778c9bc4f93ff281fee68d50467321c6cdb5cccf1b7e26a60a93aae146db62814a8ffa259394130066200f335d2518d95177b3486c1a4f32a7d81d7436b66a05a52cd9bca199ddc62f2905bd04dc050eab2988f764a05d3dd4611bb2744173eed6a9a427d3ec68fb9ceae6f4a43cd6ea62176c5c0c4b287872d81ca356688be84c50afdc4a276f98654d0fbcd564c048961fe451469b36cb22baef5be78c062e2439ee5b66eb5973ff5684702650e9d4aa8761780889d99aafd0672bc245a6b46b199efb9ddb280c1c9d8d7ac6cc2d3d6c18375fda1d05625d8a3901d09148d75b5eadbea7701ba896fce84b446d1005af041f460c2079ecdaa89a78484193c5f058709d538781236f573101d4ae9dc4514ad48af7b108e402ecb74121e8f27fa485ff0e113d58f09abebdd14307f22f9aa8bdca85756c9e5b04da6f6d5e2a4fda68a9def956fb99c00d9bbced31323926c91b7a407857734ccad3a25bb376a26616bc6fc3c37fa910ae0683164ca1027bf9b370aa5df21c565715070027d967d63f487208c2c2a040497220e92292e7247ba198aeb7dda9e453e2ba4855c58b76fae2f134492254d2c8b0ea73f98fa21802b215f2e552a61fac0cc5d7f9c19e097d7ff94f68bf687c9134c7794ed2f2dc460a1f2a8cf8a1563567ad69ba363e63a5b0fe80cc58cd174d8139e8abfa2f9a98fdede5c277f63478029169d2138819354a52756f1478e28d4a15f49b96ac507eef7b2c6f81c4d0bc00dd35b62b5310b2a39839777d14d8f062bd1250bbcbeef744234de89155b04a9b2040386566298763796bdb06f5ee58cb6d061a1dff571ee11ffb7b5430754fcdbbf3ba8aa25ff173795644a26ef3ba6de94eb24699fcc11f0a0bb3011d9e7c920ba753fa7b3d8104f22f9287071ddec652863d6496a18e0139c224c5d37abd533ee93bc3863e5c81faea549df3f9cc14ec3cbf6211fbabeea3603c941dcfcfa2def8c52ee0cbed917ec296dbaef210a88205bee399bba81bfada6e46ca126c12e6ac0842603b9cb93a59b57dc11ec975277981ea334c1fa7cca2b212ae3d2adbd561a7254ce1cc3349d2827680016a5ff2ed3e1850a269cd7aa31624cddcc227369fa95c7c349c49b276bcfed4843a28116fab25aa416e2d20fe6d1f5177df32ed161957e797782fcbbe10a763dc9f7a3e1912b09ca46fc03f641059cd10ec0f55a106fa088af84e76820dcddedf3198c93e666da66354e8429264aac64e4ae1b0d69f5409761434a617ba90d6a5a741ea004a001bb8aa86661408e91b35229d4263d035735291dcb5d787efce3e7e249f06e16b8f693e9a5869f4a1ded850b81fb59abffdb475f127bbd935ae887efdbb8c294c985c7af3f89ed24b35fed49c2afbc93210f041fcbc61b8ac6c12f62c2b3c4c160c159a88729c3ab93232ec5affa64d106c67f2a07c7597bbfaccea2ad279c80888b0374cf3e69d6be2f973337249f88d4267a0ca474d318f7aeea29515306adb686ac510013ab2ae9007bf2ddd58fadc59be4134b8dc1177d2be61dde050d739a81d41e457274901407e52775d4ef9fcb234bd0f3f358bb933bad7e459b595e31b819d79c44ba53bd21d7bb9c1c88ea909b9f0be259ed1025afd8a999e27dbec332d37f64b786db16e9abc619a88477b9434b4a9134f40f6993641da0b501de11eb8e81938226f3bbe02c8c16daca173bb4b5d8f481726bd04f5b035e47b60ee1bef51618ffbb4915da9ec98704f8642bda0abd2013f687a8f9afa81d7cdb2ed7db659c7e61745e6821f4a4370b70533c4478e920da810485a431875e7913ec3df124e77a825825b656255dae55d85447f5e03373b9e3a8c47195aae3655d29e75210d3bb1cb32f4d30c67b7dcca93d0f679071be15eff8b71f55b54dcc98d35f4c177af9deb8853e30c660b560f0a7749de7f91d7328e6c8b48f68caaca2c2c87bca1aa0e690c9d4af77b73aa2138a0a40990eb10373861eb5841f6d9b5eb546350dea4db40f630b3106f9a730ebe5f1d1b879614cb68c3ca381c2b7b8b90debd38c7d2b860921b41be8932aad75813a032d5095f2fdd92e5478e6f61e968091c964409b0678637584b19f72fa8bcc2d9baff37afbb604f7f4ef120c1fdc7e900ff5b84c7d6f079e4244ec0ef7de8b3f50332e1f278ca4b466d13198b34f10934d72cb63c65e481279ef6599face0123d9ae5449c0c42a5aebf4737d3fb4d5af9b75326eeca16e7970b4dc841d73fdf1f81d8b9580c85ed77b9aa3859f0d6f4283aba1752c6ff233b2bf83da453e1909c52720161c8649c4d7895b90a0e1580478e8304e8a32ddfc185ae01b800732508c155ad70a4ab823b0f43133e6d15137a5ec1ea5d39d596f20de9331831564a5a4ebf0ed0da515b2adaa4c43e91d269f7307fa2ae724d677adb9cf053b2a5c4c0d259333257109aad5f79800c111eed05f6e136e001bdae56b021d78b12ea6bedbec06f9ebd06883b697ae4773ad9e4c9eedf51ea85d32ca0c03dc0d691ae977b98b69c64d741b227f283031963b10ba211d280da7b8d828b77f39cd98bdc61c306f00bd0bea58cc74206cb20b5cee4ebeeb388a129a1b48ae0fd30ef52005ba1437dd69da60b449f4c1cbf773ebbd3b2500f8dd58191fbd15baac67ff801c1b98398d80969a8850b640463ec0d006eacdba62c76e6dd5a1432bce30161bd9e6e27a11c8ab9333dd50dc3033509ba467ebf3597e2cd8115b5ecf62a9b2ffbd2cc826b00ddc4936fb10c011ec9fb19a383111668ca843965306df16532e9719e3b6cf64128a5c2c57a4b99ea8ff408eb296b27fe19d4d4523114b56b40628520783468448519825bf72fc692a8032e7f052dc2ea51c6d378053fe0f8824651ef76be6cdfd67c2ec3b01206647fd800e737bbe1c9d8c94360927242a05ed012a053bb2da9860907fd791bce04644e80a36d520ef1b0c40994c027ccf06ba64c8287814eed6f32f8657ab5bb2dadc299a812e2e822c52db37d9a11b57a0c7b4cb66b6cf43b711aed61b9aa0d06afd426cbefbb2b8db02ffaa298223aa2b07fb0efbd458e6f35f1e0a76d8a53e214ee56cd5d3253b4134a32875da7aff7771889703763e13bedb40f704edaa393266ac6915f1f491ddcf8118a77c17976b818ab38677bd7ac3f77f807f6b99a8ce761176aad82bf01c231d257cd7271b7d085e89572471e0c5a917d556d856ae71329d34af5bca3f3a449a2eaa1fbe98605d463e2b9060b02cb2ec3527baca27d0135e54482546588d33dd220b352d63a678dbb693c5d76e2889ed375f82c66ce55af9af7c3adb9ab4a3b4a062ac6ae1c62acc5e84565ac7db02ece1d215e20b96a0cd81bf2889b952b69ef19f8f58044044204cd0ee0d7514c96eb2e9b72b538c76c6763bf9d3173533b258768db25f59d2aee022aa3ef0e5d7da4c7ece8d33422410e85366ecfda39790d83bda55c6ed64b0907c520acd6afd7ed298c8db2dad1b732d48c22f9ed0a39515146a1cfee7c99bcc9121d301f6a85e77dab48292988f2a5e2746867afdaf41e0da976b9d9d3d12b4172cfbb7de9a1848b7db9786f0f68a1e6b1eb5a766e551b5b643af9ce44832d215a6062043c1555eeaa4d7d7e46e0d5325b7e18e422c0411518c96682b3ab5ad753b911bbef2116d58ac68da1fbd896e2955bfd3bc494e2a1b6ad20e73d56d62d50bf20ed68165a7f6b80faa864d3a5dbe56893b27802e7f878ed657b1cea02668770709429bdcfa801347bb3b3173be3233e6a5bbb74559dc853e765da8a03e71ace3b6478ad8d726c021254ada64f28661b7540399281e9c301ea58dc600901a187476d80753ace72b10d786b0cc28b7c656ae460a083efd982b3cbf3aed57d97bdd3cb992d27b900b8a9f90c20a2c56f9e50589e754abcccb3df2693c475052ad2c9225cd83c2fabe67bc74106eb6eaf73d484c5792f42c0d4a910c8ece7eee7e6042e1cf74509eef3eaa55b2d6c2d2ad90534495775ebdac4f8e846082dce94895babc2b816a4a207d49adf8ada409004cd13bde9042e16060222bfb7f4a1a4328d3d89580f9a8702fc43bd78040533e4dc033196319404bdde0432f8b848baf114aa2dea3ac87d62002eefd36c53d15fd5c0678f80c1dd12dad5ea78ca0020032b1a77d5cf0312888c9d850e489b58abd7e34f86531eafe888b1803fa8be61f40cf7d81c5c834d6216036917dc6e5f3a1e9d2128518ec086786467fa4e2a3cfd9f73498c82fa99d9742e85fff23e8ca15910b07d18c744c4a3fafe962c0af07d6078be0bc59ae20ae391db8fa54ab7a0246503bb3635d895ee36d37d0458ecfeafeca37b9b02e9b73ae5e6ef4141374485155cfb8fb76e78e095b2c49f342aa842604743d49d7e8b84169ec424a48840635fa12503d44dcf98a758acf0615e4e61ca808f744c94b7ac334f39a6a22f7eec5ee375f70f756298ef63dadd2b9a5401b2ed97e7cced9e6d1c39189c897ca78807d83fbe2482f2ca9710547e3878e0536133759c6e976d85b179f3aa7645b12b0e9346e9fc266a19fb1447fb881fd2e6687b98d00da797237f8166a450b32bf85e8c73bac4ae21aaaa5a9feab2a2da5165eb486ada63a73de91c9728d84733cbb3ea063dc827cc07d5040110937bbf0e2019999506b687b875236995375e19dbe2f8d3505f240af7cde003d6b8a92626c8b8e73b563028d56ec084cc3adb168a10fc78d878c956b178184d16b9bd73b2f0ef7343c4ec3c5f65959cdbba6bcf6f3856f7ea44462cf8046a0033a4a534410affa8d40000000da4313dde0dce4848c41e935f06814c6bbba5cc0e61c5cceec86e7e9795aa77446ee77f1ada16ec135757ac00f2626eba1edcdec6c4b8c05240df9956eeacaf9	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "0018C01773CE6FF0"	svchost.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production	reg.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018C01773CE6FF0 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000139c23cd03211c47afdce08e2bfc652a00000000020000000000106600000001000020000000743ff8f21f9e7b1e617b236920a2d6f563f549adcf336098d693b18d595043bf000000000e8000000002000020000000acb811adbdf03fa0192b84dff537e114d168203104508a9e72407b5222aa2086800000000a20643048b94dd1f04cb39c3cb10de0ea57050fc973177bca8c7849f28c597b073f77634df3661f08af53c2a8a0450429130a0061f9f7e19a614a1262b159413d3797f423d464e679409a945da1daac44870f4026b8b151dabd45b79a01bfe1ae76b7935e96b50aa2b5d081009be824ed3539bf42f073c9d2bbbb9c1f359b1e4000000012188b3581f6d4775a42512dff959f9acbff1b7169f7a71166446333851ad2c703f1443f7099a5e68e122a7e1ed47fcf9982be71e7d1656667d3d28ab66b7746	svchost.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL	reg.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321482766676213"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive	reg.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{77E2841A-360D-4ED2-BC77-4288D420A721}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies registry key 1 TTPs 55 IoCs

Modify Registry

T1112

pid	Process
4172	reg.exe
4876	reg.exe
3932	reg.exe
2712	reg.exe
1392	reg.exe
2304	reg.exe
3892	reg.exe
4372	reg.exe
4284	reg.exe
560	reg.exe
3448	reg.exe
3144	reg.exe
4372	reg.exe
2480	reg.exe
1468	reg.exe
4164	reg.exe
760	reg.exe
3416	reg.exe
2372	reg.exe
4468	reg.exe
4844	reg.exe
2304	reg.exe
4548	reg.exe
4620	reg.exe
4172	reg.exe
3948	reg.exe
3836	reg.exe
3932	reg.exe
1980	reg.exe
4284	reg.exe
3080	reg.exe
5060	reg.exe
3860	reg.exe
3836	reg.exe
3932	reg.exe
1488	reg.exe
3416	reg.exe
4372	reg.exe
2480	reg.exe
980	reg.exe
4844	reg.exe
3908	reg.exe
404	reg.exe
1980	reg.exe
2848	reg.exe
3584	reg.exe
5104	reg.exe
760	reg.exe
4676	reg.exe
2976	reg.exe
5752	reg.exe
5452	reg.exe
3416	reg.exe
1536	reg.exe
4128	reg.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1856	PING.EXE
1296	PING.EXE
4148	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5064	powershell.exe
5064	powershell.exe
5064	powershell.exe
1496	powershell.exe
1496	powershell.exe
1496	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
1296	powershell.exe
1296	powershell.exe
1296	powershell.exe
864	powershell.exe
864	powershell.exe
864	powershell.exe
2372	powershell.exe
2372	powershell.exe
2372	powershell.exe
2856	powershell.exe
2856	powershell.exe
2856	powershell.exe
4172	powershell.exe
4172	powershell.exe
4172	powershell.exe
404	powershell.exe
404	powershell.exe
404	powershell.exe
4188	powershell.exe
4188	powershell.exe
4188	powershell.exe
3940	powershell.exe
3940	powershell.exe
3940	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
3988	powershell.exe
3988	powershell.exe
3988	powershell.exe
1392	powershell.exe
1392	powershell.exe
1392	powershell.exe
5204	powershell.exe
5204	powershell.exe
5204	powershell.exe
5672	powershell.exe
5672	powershell.exe
5672	powershell.exe
5804	powershell.exe
5804	powershell.exe
5804	powershell.exe
5920	powershell.exe
5920	powershell.exe
5920	powershell.exe
5500	powershell.exe
5500	powershell.exe
5500	powershell.exe
5860	powershell.exe
5860	powershell.exe
5860	powershell.exe
4584	powershell.exe
4584	powershell.exe
4584	powershell.exe
4524	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeIncreaseQuotaPrivilege	3892	WMIC.exe
Token: SeSecurityPrivilege	3892	WMIC.exe
Token: SeTakeOwnershipPrivilege	3892	WMIC.exe
Token: SeLoadDriverPrivilege	3892	WMIC.exe
Token: SeSystemProfilePrivilege	3892	WMIC.exe
Token: SeSystemtimePrivilege	3892	WMIC.exe
Token: SeProfSingleProcessPrivilege	3892	WMIC.exe
Token: SeIncBasePriorityPrivilege	3892	WMIC.exe
Token: SeCreatePagefilePrivilege	3892	WMIC.exe
Token: SeBackupPrivilege	3892	WMIC.exe
Token: SeRestorePrivilege	3892	WMIC.exe
Token: SeShutdownPrivilege	3892	WMIC.exe
Token: SeDebugPrivilege	3892	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3892	WMIC.exe
Token: SeRemoteShutdownPrivilege	3892	WMIC.exe
Token: SeUndockPrivilege	3892	WMIC.exe
Token: SeManageVolumePrivilege	3892	WMIC.exe
Token: 33	3892	WMIC.exe
Token: 34	3892	WMIC.exe
Token: 35	3892	WMIC.exe
Token: 36	3892	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3892	WMIC.exe
Token: SeSecurityPrivilege	3892	WMIC.exe
Token: SeTakeOwnershipPrivilege	3892	WMIC.exe
Token: SeLoadDriverPrivilege	3892	WMIC.exe
Token: SeSystemProfilePrivilege	3892	WMIC.exe
Token: SeSystemtimePrivilege	3892	WMIC.exe
Token: SeProfSingleProcessPrivilege	3892	WMIC.exe
Token: SeIncBasePriorityPrivilege	3892	WMIC.exe
Token: SeCreatePagefilePrivilege	3892	WMIC.exe
Token: SeBackupPrivilege	3892	WMIC.exe
Token: SeRestorePrivilege	3892	WMIC.exe
Token: SeShutdownPrivilege	3892	WMIC.exe
Token: SeDebugPrivilege	3892	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3892	WMIC.exe
Token: SeRemoteShutdownPrivilege	3892	WMIC.exe
Token: SeUndockPrivilege	3892	WMIC.exe
Token: SeManageVolumePrivilege	3892	WMIC.exe
Token: 33	3892	WMIC.exe
Token: 34	3892	WMIC.exe
Token: 35	3892	WMIC.exe
Token: 36	3892	WMIC.exe
Token: SeDebugPrivilege	1296	powershell.exe
Token: SeIncreaseQuotaPrivilege	1468	WMIC.exe
Token: SeSecurityPrivilege	1468	WMIC.exe
Token: SeTakeOwnershipPrivilege	1468	WMIC.exe
Token: SeLoadDriverPrivilege	1468	WMIC.exe
Token: SeSystemProfilePrivilege	1468	WMIC.exe
Token: SeSystemtimePrivilege	1468	WMIC.exe
Token: SeProfSingleProcessPrivilege	1468	WMIC.exe
Token: SeIncBasePriorityPrivilege	1468	WMIC.exe
Token: SeCreatePagefilePrivilege	1468	WMIC.exe
Token: SeBackupPrivilege	1468	WMIC.exe
Token: SeRestorePrivilege	1468	WMIC.exe
Token: SeShutdownPrivilege	1468	WMIC.exe
Token: SeDebugPrivilege	1468	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1468	WMIC.exe
Token: SeRemoteShutdownPrivilege	1468	WMIC.exe
Token: SeUndockPrivilege	1468	WMIC.exe
Token: SeManageVolumePrivilege	1468	WMIC.exe
Token: 33	1468	WMIC.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe
3392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 1768	3392	msedge.exe	85
PID 3392 wrote to memory of 3208	3392	msedge.exe	87
PID 3392 wrote to memory of 1616	3392	msedge.exe	88
PID 3392 wrote to memory of 1616	3392	msedge.exe	88
PID 3392 wrote to memory of 1616	3392	msedge.exe	88
PID 3392 wrote to memory of 1880	3392	msedge.exe	89
PID 3392 wrote to memory of 1880	3392	msedge.exe	89
PID 3392 wrote to memory of 3272	3392	msedge.exe	90
PID 3392 wrote to memory of 2272	3392	msedge.exe	91
PID 3392 wrote to memory of 3272	3392	msedge.exe	90
PID 3392 wrote to memory of 3272	3392	msedge.exe	90
PID 3392 wrote to memory of 2272	3392	msedge.exe	91
PID 3392 wrote to memory of 2272	3392	msedge.exe	91
PID 3392 wrote to memory of 3984	3392	msedge.exe	92
PID 3392 wrote to memory of 3984	3392	msedge.exe	92
PID 3392 wrote to memory of 3984	3392	msedge.exe	92
PID 3392 wrote to memory of 2384	3392	msedge.exe	93
PID 3392 wrote to memory of 2384	3392	msedge.exe	93
PID 3392 wrote to memory of 2384	3392	msedge.exe	93
PID 3392 wrote to memory of 3560	3392	msedge.exe	97
PID 3392 wrote to memory of 3560	3392	msedge.exe	97
PID 3392 wrote to memory of 3560	3392	msedge.exe	97
PID 3392 wrote to memory of 3800	3392	msedge.exe	98
PID 3392 wrote to memory of 2456	3392	msedge.exe	99
PID 3392 wrote to memory of 3800	3392	msedge.exe	98
PID 3392 wrote to memory of 2456	3392	msedge.exe	99
PID 3392 wrote to memory of 1872	3392	msedge.exe	104
PID 3392 wrote to memory of 3516	3392	msedge.exe	116
PID 3392 wrote to memory of 1564	3392	msedge.exe	117
PID 3392 wrote to memory of 2096	3392	msedge.exe	118
PID 5064 wrote to memory of 2068	5064	powershell.exe	120
PID 5064 wrote to memory of 4860	5064	powershell.exe	121
PID 4860 wrote to memory of 2728	4860	cmd.exe	123
PID 4860 wrote to memory of 4284	4860	cmd.exe	124
PID 4860 wrote to memory of 1952	4860	cmd.exe	125
PID 4860 wrote to memory of 5104	4860	cmd.exe	126
PID 4860 wrote to memory of 404	4860	cmd.exe	127
PID 4860 wrote to memory of 4740	4860	cmd.exe	128
PID 4860 wrote to memory of 4372	4860	cmd.exe	129
PID 4860 wrote to memory of 4760	4860	cmd.exe	130
PID 4860 wrote to memory of 4744	4860	cmd.exe	131
PID 4860 wrote to memory of 2512	4860	cmd.exe	132
PID 4860 wrote to memory of 924	4860	cmd.exe	133
PID 924 wrote to memory of 1296	924	cmd.exe	134
PID 924 wrote to memory of 4056	924	cmd.exe	135
PID 4860 wrote to memory of 1824	4860	cmd.exe	136
PID 4860 wrote to memory of 4524	4860	cmd.exe	137
PID 4860 wrote to memory of 440	4860	cmd.exe	138
PID 4860 wrote to memory of 4616	4860	cmd.exe	139
PID 4616 wrote to memory of 1496	4616	cmd.exe	140
PID 4860 wrote to memory of 644	4860	cmd.exe	141
PID 644 wrote to memory of 2060	644	cmd.exe	142
PID 4860 wrote to memory of 4172	4860	cmd.exe	143
PID 4860 wrote to memory of 4716	4860	cmd.exe	144
PID 4860 wrote to memory of 4284	4860	cmd.exe	145
PID 4860 wrote to memory of 3516	4860	cmd.exe	146
PID 4860 wrote to memory of 3080	4860	cmd.exe	147
PID 3516 wrote to memory of 2096	3516	cmd.exe	150
PID 3516 wrote to memory of 4524	3516	cmd.exe	151
PID 3516 wrote to memory of 1980	3516	cmd.exe	152
PID 3516 wrote to memory of 2512	3516	cmd.exe	153
PID 3516 wrote to memory of 1952	3516	cmd.exe	154
PID 3516 wrote to memory of 5060	3516	cmd.exe	155
PID 3516 wrote to memory of 1120	3516	cmd.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff8bba5c188,0x7ff8bba5c194,0x7ff8bba5c1a0
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,15065364038972650460,1467532854874830428,524288 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,8479432559977793721,2512597120000097574,262144 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,8912919519703679191,14500419454378137507,524288 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,17648249915649512688,6018926623952647921,2097152 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,2245847264071832367,16722734043310813123,2097152 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,9372054395056864670,3669509834891023671,2097152 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,11650455035180889133,3792819190024271063,2097152 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5096,i,7027932166018356929,14087222015898704560,2097152 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,7357877723793224508,13631269228487778543,524288 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,18338009772589731669,15364144151887565935,524288 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,15673830389233677745,9461172628051308192,524288 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,15673830389233677745,9461172628051308192,524288 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,5597077981830670766,6374201626730686086,524288 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,16895839290258291221,2313721758337215436,524288 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,17621701911138233392,10273318789010949954,524288 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,13266171822188479763,15967176181953551156,524288 --field-trial-handle=2380,i,5354256780566221373,2348157608946651269,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:2480

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4900

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "echo CMD is working"
  2⤵
  - Executes a command shell one-liner
  PID:2068
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ""C:\Windows\Temp\MAS_9ae8f649-3046-415f-a86f-40e32035b55d.cmd" -el "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:2728
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:4284
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "C:\Windows\Temp\MAS_9ae8f649-3046-415f-a86f-40e32035b55d.cmd"
    3⤵
    PID:1952
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-el" "
    3⤵
    PID:5104
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:404
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:4740
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:4372
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:4760
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
    3⤵
    PID:4744
- - C:\Windows\System32\find.exe
    find /i "ARM64"
    3⤵
    PID:2512
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:1296
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:4056
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_9ae8f649-3046-415f-a86f-40e32035b55d.cmd" "
    3⤵
    PID:1824
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:4524
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:440
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_9ae8f649-3046-415f-a86f-40e32035b55d.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_9ae8f649-3046-415f-a86f-40e32035b55d.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1496
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:2060
- - C:\Windows\System32\reg.exe
    reg query HKCU\Console /v QuickEdit
    3⤵
    - Modifies registry key
    PID:4172
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:4716
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:4284
- - C:\Windows\System32\cmd.exe
    cmd.exe /c ""C:\Windows\Temp\MAS_9ae8f649-3046-415f-a86f-40e32035b55d.cmd" -el -qedit"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:2096
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:4524
  - - C:\Windows\System32\findstr.exe
      findstr /v "$" "C:\Windows\Temp\MAS_9ae8f649-3046-415f-a86f-40e32035b55d.cmd"
      4⤵
      PID:1980
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:2512
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:1952
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:5060
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Console" /v ForceV2
      4⤵
      PID:1120
  - - C:\Windows\System32\find.exe
      find /i "0x0"
      4⤵
      PID:3860
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
      4⤵
      PID:864
  - - C:\Windows\System32\find.exe
      find /i "ARM64"
      4⤵
      PID:4872
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
      4⤵
      Executes a command shell one-liner
      PID:4712
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
        5⤵
        
        PID:4620
    - - C:\Windows\System32\cmd.exe
        
        cmd
        5⤵
        
        PID:4056
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_9ae8f649-3046-415f-a86f-40e32035b55d.cmd" "
      4⤵
      PID:4524
  - - C:\Windows\System32\find.exe
      find /i "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1488
  - - C:\Windows\System32\fltMC.exe
      fltmc
      4⤵
      PID:980
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_9ae8f649-3046-415f-a86f-40e32035b55d.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:1952
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_9ae8f649-3046-415f-a86f-40e32035b55d.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c mode con
      4⤵
      Executes a command shell one-liner
      PID:4756
    - - C:\Windows\System32\mode.com
        
        mode con
        5⤵
        
        PID:4524
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2512
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1856
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:1824
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 updatecheck312.activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1296
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:1564
  - - C:\Windows\System32\find.exe
      find /i "/S"
      4⤵
      PID:1496
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:4056
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:3448
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      Executes a command shell one-liner
      PID:440
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        5⤵
        
        PID:5060
  - - C:\Windows\System32\mode.com
      mode 76, 34
      4⤵
      PID:4872
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:4284
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:760
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:4876
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:5104
  - - C:\Windows\System32\choice.exe
      choice /C:12345678EH0 /N
      4⤵
      PID:4692
  - - C:\Windows\System32\mode.com
      mode 110, 34
      4⤵
      PID:4372
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
      4⤵
      PID:1488
  - - C:\Windows\System32\find.exe
      find /i "AutoPico"
      4⤵
      PID:1468
  - - C:\Windows\System32\find.exe
      find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:1980
  - - C:\Windows\System32\find.exe
      find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:4872
  - - C:\Windows\System32\find.exe
      find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:3860
  - - C:\Windows\System32\find.exe
      find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:2304
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:3908
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
      4⤵
      PID:4676
  - - C:\Windows\System32\findstr.exe
      findstr "577 225"
      4⤵
      PID:4272
  - - C:\Windows\System32\cmd.exe
      cmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"
      4⤵
      Executes a command shell one-liner
      PID:4692
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get CreationClassName /value
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3892
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:4056
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"
      4⤵
      Executes a command shell one-liner
      PID:3080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1296
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4716
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn
        5⤵
        
        PID:1236
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4272
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_9ae8f649-3046-415f-a86f-40e32035b55d.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:864
  - - C:\Windows\System32\find.exe
      find /i "Subscription_is_activated"
      4⤵
      PID:3932
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
      4⤵
      Executes a command shell one-liner
      PID:2096
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2372
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 10 Pro" "
      4⤵
      PID:3908
  - - C:\Windows\System32\find.exe
      find /i "Windows"
      4⤵
      PID:1488
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:3932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4172
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
      4⤵
      PID:5104
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:3932
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
      4⤵
      Executes a command shell one-liner
      PID:4176
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
        5⤵
        
        PID:1980
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:5060
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4296
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 l.root-servers.net
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4148
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
      4⤵
      PID:3376
  - - C:\Windows\System32\find.exe
      find /i "AutoPico"
      4⤵
      PID:2976
  - - C:\Windows\System32\find.exe
      find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:4128
  - - C:\Windows\System32\find.exe
      find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:4164
  - - C:\Windows\System32\find.exe
      find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:4548
  - - C:\Windows\System32\find.exe
      find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:980
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:3860
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
      4⤵
      PID:3908
  - - C:\Windows\System32\findstr.exe
      findstr "577 225"
      4⤵
      PID:1980
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:4172
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot
      4⤵
      PID:4524
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
      4⤵
      Executes a command shell one-liner
      PID:4148
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
        5⤵
        
        PID:780
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:3144
  - - C:\Windows\System32\sc.exe
      sc query ClipSVC
      4⤵
      Launches sc.exe
      PID:3836
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService
      4⤵
      Modifies registry key
      PID:3416
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description
      4⤵
      Modifies registry key
      PID:4372
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName
      4⤵
      Modifies registry key
      PID:3932
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl
      4⤵
      Modifies registry key
      PID:2480
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath
      4⤵
      Modifies registry key
      PID:560
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName
      4⤵
      Modifies registry key
      PID:5060
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start
      4⤵
      Modifies registry key
      PID:3448
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type
      4⤵
      Modifies registry key
      PID:2304
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:2372
  - - C:\Windows\System32\sc.exe
      sc query wlidsvc
      4⤵
      Launches sc.exe
      PID:780
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService
      4⤵
      Modifies registry key
      PID:3144
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description
      4⤵
      Modifies registry key
      PID:3584
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName
      4⤵
      Modifies registry key
      PID:4548
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:980
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath
      4⤵
      Modifies registry key
      PID:3860
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName
      4⤵
      Modifies registry key
      PID:4620
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start
      4⤵
      Modifies registry key
      PID:2712
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type
      4⤵
      Modifies registry key
      PID:4844
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:4676
  - - C:\Windows\System32\sc.exe
      sc query sppsvc
      4⤵
      Launches sc.exe
      PID:3892
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService
      4⤵
      Modifies registry key
      PID:760
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description
      4⤵
      Modifies registry key
      PID:3836
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName
      4⤵
      Modifies registry key
      PID:3416
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:4372
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath
      4⤵
      Modifies registry key
      PID:3932
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName
      4⤵
      Modifies registry key
      PID:3908
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start
      4⤵
      Modifies registry key
      PID:404
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type
      4⤵
      Modifies registry key
      PID:4172
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:4188
  - - C:\Windows\System32\sc.exe
      sc query KeyIso
      4⤵
      Launches sc.exe
      PID:4524
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService
      4⤵
      Modifies registry key
      PID:2372
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description
      4⤵
      Modifies registry key
      PID:4468
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName
      4⤵
      Modifies registry key
      PID:3948
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl
      4⤵
      Modifies registry key
      PID:1488
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath
      4⤵
      Modifies registry key
      PID:1392
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName
      4⤵
      Modifies registry key
      PID:5104
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start
      4⤵
      Modifies registry key
      PID:2480
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type
      4⤵
      Modifies registry key
      PID:1980
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:2848
  - - C:\Windows\System32\sc.exe
      sc query LicenseManager
      4⤵
      Launches sc.exe
      PID:5060
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService
      4⤵
      Modifies registry key
      PID:4844
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description
      4⤵
      Modifies registry key
      PID:2304
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName
      4⤵
      Modifies registry key
      PID:3892
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl
      4⤵
      Modifies registry key
      PID:760
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath
      4⤵
      Modifies registry key
      PID:3836
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName
      4⤵
      Modifies registry key
      PID:3416
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start
      4⤵
      Modifies registry key
      PID:4372
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type
      4⤵
      Modifies registry key
      PID:3932
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:3908
  - - C:\Windows\System32\sc.exe
      sc query Winmgmt
      4⤵
      Launches sc.exe
      PID:4620
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService
      4⤵
      Modifies registry key
      PID:1980
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description
      4⤵
      Modifies registry key
      PID:2848
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName
      4⤵
      Modifies registry key
      PID:1536
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl
      4⤵
      Modifies registry key
      PID:4676
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath
      4⤵
      Modifies registry key
      PID:1468
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName
      4⤵
      Modifies registry key
      PID:2976
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start
      4⤵
      Modifies registry key
      PID:4128
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type
      4⤵
      Modifies registry key
      PID:4164
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:864
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:1392
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:1496
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:2480
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:560
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:1476
  - - C:\Windows\System32\sc.exe
      sc query ClipSVC
      4⤵
      Launches sc.exe
      PID:4172
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:2848
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:4524
  - - C:\Windows\System32\sc.exe
      sc query wlidsvc
      4⤵
      Launches sc.exe
      PID:2372
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:3144
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:3948
  - - C:\Windows\System32\sc.exe
      sc query sppsvc
      4⤵
      Launches sc.exe
      PID:3416
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:3940
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:3932
  - - C:\Windows\System32\sc.exe
      sc query KeyIso
      4⤵
      Launches sc.exe
      PID:3788
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:2712
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:3448
  - - C:\Windows\System32\sc.exe
      sc query LicenseManager
      4⤵
      Launches sc.exe
      PID:1536
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:4172
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:4548
  - - C:\Windows\System32\sc.exe
      sc query Winmgmt
      4⤵
      Launches sc.exe
      PID:864
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:1392
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:1476
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      PID:4188
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:3448
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService get Version
      4⤵
      PID:4288
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      Executes a command shell one-liner
      PID:1476
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "0" "
      4⤵
      PID:3948
  - - C:\Windows\System32\findstr.exe
      findstr /i "0x800410 0x800440 0x80131501"
      4⤵
      PID:4844
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d
      4⤵
      PID:780
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul
      4⤵
      Executes a command shell one-liner
      PID:3376
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore
        5⤵
        
        PID:4620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3940
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
      4⤵
      PID:2976
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"
      4⤵
      PID:2848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4288
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_9ae8f649-3046-415f-a86f-40e32035b55d.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:3948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_9ae8f649-3046-415f-a86f-40e32035b55d.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3988
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"
      4⤵
      PID:2712
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"
      4⤵
      PID:864
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:760
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE
        5⤵
        
        PID:2976
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
      4⤵
      PID:3940
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4372
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE
        5⤵
        
        PID:1536
  - - C:\Windows\System32\sc.exe
      sc query wlms
      4⤵
      Launches sc.exe
      PID:4788
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"
      4⤵
      PID:1008
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"
      4⤵
      PID:3940
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"
      4⤵
      PID:3988
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"
      4⤵
      PID:3944
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:864
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"
        5⤵
        
        PID:2976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1392
  - - C:\Windows\System32\findstr.exe
      findstr /i "KMS_"
      4⤵
      PID:4288
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:5188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5204
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "
      4⤵
      PID:5324
  - - C:\Windows\System32\find.exe
      find /i "Ready"
      4⤵
      PID:5332
  - - C:\Windows\System32\reg.exe
      reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f
      4⤵
      PID:5356
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"
      4⤵
      PID:5372
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "
      4⤵
      PID:5388
  - - C:\Windows\System32\findstr.exe
      findstr /i "Removed Not Found"
      4⤵
      PID:5396
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:5420
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE
        5⤵
        
        PID:5436
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 0ad2ac98-7bb9-4201-8d92-312299201369 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5 221a02da-e2a1-4b75-864c-0a4410a33fdf 291ece0e-9c38-40ca-a9e1-32cc7ec19507 2936d1d2-913a-4542-b54e-ce5a602a2a38 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 3502365a-f88a-4ba4-822a-5769d3073b65 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 60b3ec1b-9545-4921-821f-311b129dd6f6 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 6365275e-368d-46ca-a0ef-fc0404119333 721f9237-9341-4453-a661-09e8baa6cca5 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 82bbc092-bc50-4e16-8e18-b74fc486aec3 8ab9bdd1-1f67-4997-82d9-8878520837d9 8b351c9c-f398-4515-9900-09df49427262 90da7373-1c51-430b-bf26-c97e9c5cdc31 95dca82f-385d-4d39-b85b-5c73fa285d6f a48938aa-62fa-4966-9d44-9f04da3f72f2 b0773a15-df3a-4312-9ad2-83d69648e356 b4bfe195-541e-4e64-ad23-6177f19e395e b68e61d2-68ca-4757-be45-0cc2f3e68eee bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 df96023b-dcd9-4be2-afa0-c6c871159ebe e0c42288-980c-4788-a014-c080d2e1926e e4db50ea-bda1-4566-b047-0ca50abc6f07 e558417a-5123-4f6f-91e7-385c1c7ca9d4 e7a950a2-e548-4f10-bf16-02ec848e0643 eb6d346f-1c60-4643-b960-40ec31596c45 ec868e65-fadf-4759-b23e-93fe37f2cc29 ef51e000-2659-4f25-8345-3de70a9cf4c4 f7af7d09-40e4-419c-a49b-eae366689ebd fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab fe74f55b-0338-41d6-b267-4a201abe7285 " "
      4⤵
      PID:5476
  - - C:\Windows\System32\find.exe
      find /i "4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c"
      4⤵
      PID:5484
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="VK7JG-NPHTM-C97JM-9MPGT-3V66T"
      4⤵
      PID:5508
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      Executes a command shell one-liner
      PID:5548
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
      4⤵
      PID:5564
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul
      4⤵
      Executes a command shell one-liner
      PID:5612
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Control Panel\International\Geo" /v Name
        5⤵
        
        PID:5624
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul
      4⤵
      Executes a command shell one-liner
      PID:5640
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Control Panel\International\Geo" /v Nation
        5⤵
        
        PID:5656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_9ae8f649-3046-415f-a86f-40e32035b55d.cmd') -split ':sign\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service ClipSVC } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5920
  - - C:\Windows\System32\ClipUp.exe
      clipup -v -o
      4⤵
      PID:5356
    - - C:\Windows\System32\clipup.exe
        
        clipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\tem5F3D.tmp
        5⤵
        Checks SCSI registry key(s)
        
        PID:5408
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
      4⤵
      Executes a command shell one-liner
      PID:5492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5500
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 10 Pro" "
      4⤵
      PID:5564
  - - C:\Windows\System32\find.exe
      find /i "Windows"
      4⤵
      PID:5632
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate
      4⤵
      PID:5668
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b -805307370
      4⤵
      Executes a command shell one-liner
      PID:5740
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
      4⤵
      PID:4068
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:5604
  - - C:\Windows\System32\reg.exe
      reg delete "HKU\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:5676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service wlidsvc } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5860
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service LicenseManager } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4524
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service sppsvc } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      PID:5388
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5540
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
      4⤵
      PID:5876
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate
      4⤵
      PID:5060
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      Executes a command shell one-liner
      PID:6116
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
      4⤵
      PID:6104
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:6092
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL"
      4⤵
      PID:4012
  - - C:\Windows\System32\reg.exe
      reg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "State" /f
      4⤵
      PID:5936
  - - C:\Windows\System32\reg.exe
      reg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "SuppressRulesEngine" /f
      4⤵
      PID:5884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Stop-Service sppsvc -force } | Wait-Job -Timeout 20 | Out-Null; $TB = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$TB.DefinePInvokeMethod('SLpTriggerServiceWorker', 'sppc.dll', 22, 1, [Int32], @([UInt32], [IntPtr], [String], [UInt32]), 1, 3); [void]$TB.CreateType()::SLpTriggerServiceWorker(0, 0, 'reeval', 0)"
      4⤵
      PID:5672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2504
  - - C:\Windows\System32\choice.exe
      choice /C:10 /N
      4⤵
      PID:5408
  - - C:\Windows\System32\mode.com
      mode 76, 34
      4⤵
      PID:5480
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:5752
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:5588
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:5452
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:5516
  - - C:\Windows\System32\choice.exe
      choice /C:12345678EH0 /N
      4⤵
      PID:5444
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:3080

C:\Windows\system32\Clipup.exe
"C:\Windows\system32\Clipup.exe" -o
1⤵
PID:4876
- C:\Windows\system32\Clipup.exe
  "C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\TEMP\tem576D.tmp
  2⤵
  - Checks SCSI registry key(s)
  PID:2712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GenuineTicket

Path C:\ProgramData\Microsoft\Windows\ClipSVC\GenuineTicket\GenuineTicket
Size 1KB
SHA256 5cf3ae9ca793d9a8517d05864eacca525ae8b4db3d13943edcc4bf3f2131dab4
MD5 5e22ef25ec6bdbe63cedfbdf75011316
SHA1 d828c721daf6c630960838dd3a9391d2ec62e88f
SHA512 8599d461fbe166906bc42d2ac6235d32a0f32ea247dbf1bad76ca72233df7b5907c7ebb57b943a3e51d0dae8825baca396f2dd79a34b00197f9dcaa8d6a37714
TLSH
T1381123B4D5356C10221C67F086713BD3BB1C314BC6935D29FB41579835AA2823B57029
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9ddbaafb04a0c7e73a181b3e536f69fd53033b6bdd8cde973368343ee0f5d002
MD5 ad523673da2fdb8d7b6d71eed596e2f4
SHA1 f49bc53982f033fcea48b2ac36ac8176a0862813
SHA512 bce9a3c0c02c3b8fdedcd398ebbbf230a5ebfcec28c24ab811bbe549fb0aa8b97dd0d50ad75b18568f5d68c3b1d1a15d8ae890890a552dc028943c09fef4e7cf
TLSH
T1F961D4A8CE421B95FBA01337ECE20A5534B584D90E5F8F6110BD9FFC6914B68FD3241A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bc073fe3c86bb501dce569373976e4b17151b3541c6422d584ee83bf56037a4a
MD5 750816aba03f7066f6b92055024a445b
SHA1 4ee2ba3e02d93daa063de9bfcc945d5cfdf78bb1
SHA512 04ba2496542cadd846b78cdfbdfc3fb7fc0e3721f7c2ebc1691798f39fb60b11248e293b3462163c0c3fe4ba1bc912f53b0f0119fd7124da20d26ea7281fca39
TLSH
T18E7149B7C3D9C22D891156F49B15AF2FCE2D0614832D3C2A88D9BF6B93E2431E11565E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e507630fcce6b3ce9bbb5ac29233d7ace0de5f8ba2c13f8cc9013f2e21f5dc22
MD5 6196451292d8c3510f4e22ac5dba2c6e
SHA1 974488505f1e627bd3837cede77abf97b987fba7
SHA512 92bd62bd71eea64d75b45cd27bf40d06680c85488d208198040456b18f67cf7c36b5a41850da716c2b93e1cbd2fa5724a7f49fcb19bc8cac293abe5798fccce2
SSDEEP 192:sxZhRpyM/jK1Ml8MkZ/ffssr/IdpqNDHW6+WNrbp/YHho9RWIgrJ:sxZhXMZ/ffssrwUHb5/On9
TLSH
T1C652E912AA385977CCCBD209FA55BB53D6F90472A2901E44A9FCDA1C04E7FED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4e041cbb6fe59d82e36c9a3bee409c6e4ac95ac3ab847459d691fb474d0e482d
MD5 b22072bf84b243057fb217415e372dd9
SHA1 6609467fcf7c050880386320bec16e3d02b907ec
SHA512 4c0767372525d66fcaabeb44d6f364b6e7ea7bbef91027a51f4f97dc954e5a26af8feb940d0839db64d3720ea6f40d19c2da9f983533d763692c9fdbad375199
SSDEEP 768:WhUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RBroVw0S:WhUZYTMWvg0Pou1ja7eLZmR6ZS
TLSH
T132D20B3B280CCB7E4F844E9DEC2A6F963ED801CB5A584D5447EA894C03C76EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 56f06af0f52ab657865116f1dad49db68a005a6494486f8f24055210cd1e596d
MD5 5d0d7a61b35c95662ecc903174d4409c
SHA1 1e91067e706ae3e7711d1d14de93017cfe781ff1
SHA512 64a42b258e40e0c7bcfa8d45fae47553f0020a1a1e41d0d02d1f8d08c5572e045a93ebe623186c9446220708e2760fb8733493fc372c03f8fd6186c135911937
TLSH
T148A0023567C54861FC040A75E0960B842360981542399303C4A0009DEDB32415946511
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 90ca8b7f792524cce3625d84fd13eaba3f454d336c9f2e3d98d085233e640a80
MD5 5687276ed1e31f29f91dbc8ef803c927
SHA1 11736e331ac2d849091ebb1bf0409cf185b6a43c
SHA512 2f5721d6790e737276657f93ffd7ac012c30a9af41b032151b752b9e5d610667fb602032e90143bc172af7d3af060ab5e57841e9d41d98c4e082bfd669e9cc6b
SSDEEP 96:KA1eK2AseUKXqlmd+KuARvmK0UyiQAKlil:EWE1r9nq
TLSH
T100D1C21671BA03113C7D2A1C86B59B668E417563702DA52F7FAD00B54E2AE209FFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5935cc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5935cc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9c734c734ddfc9eaa61d3e4e8b818ea8263a6160abe3c97d70ed6ed5edd794e9
MD5 6d0edba42c35e738a9b5b1670f31908b
SHA1 39cdff9be3bfab72241a317ac9544956bd54daaf
SHA512 b21e67f5348176f911d028787121388b45cdd33629c754cbb99ae7cea504def4ee1c7e4b55ff2fae89796ce998dc27ea9e378573c148073e1ee44c314cd945fe
SSDEEP 384:XZcIksN5j8TWhfzX5od+2d6/Id+2CL/DivruGoj:fkGzOv3lCL/DiDuGc
TLSH
T17A827D325C686C7749E6F545F54B75138FB88067DBC96F8090EC9B2C01DAAEC131BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 75e5c639e783bfc984d9b013890d229ef013dabf14d16e958e8cf3f049dbe2e3
MD5 729a826a0c3d175cbb2ae5681ef9d227
SHA1 32b7867818ff3be1d138a2b5bbb8ab66055730a8
SHA512 c06f8c96e45a63f192d01f0ec4b2967e3856426dc480f928605de50e494b3ce9454a846afabb94a7c527864532e9b1ad2139d902f7efe8a627729c31b06172f7
SSDEEP 384:3iFNZcIjsNb8TUNTUlIlg8TZ9fzX5od+2d6/Id+2CLaDivruGoj:yFVjOwgDzOv3lCLaDiDuGc
TLSH
T1ADC21AF248D79836D9AD9743E77E2D038EBCC063B5856A80B3D8961CCC565BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2273b8898b2e0fbe87f0e0fffefc1650f9f53a93ad80e8dc58f720c0d8d5d788
MD5 6d404eaefe1ba646f0edfd82265d67f4
SHA1 825b4a9b7b6ad095236b2bef078a225563e53c40
SHA512 1b006d8b3547e4eff1d67966478e88c016f9adff46241ceeb2567f6f9302d79d3396a5d72fb66335ca1b595f6686426e1811b3d8c1892b450a9cb8cb01fe599e
SSDEEP 384:CZcILsN5j8TZhfzX5od+2d6/Id+2CLmDivruGoj:wLRzOv3lCLmDiDuGc
TLSH
T109827D325C686C7749E6F545F54735138FB88067DAC96F8095EC9B2C01DAAEC131BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 974137ba1ab1d63b256166b9db843a02e448d21666f38eec1e7d2ac79ab529c0
MD5 00f164548be0bbaa6b382152c43db3e0
SHA1 c5f9aaf465b4c70df1dfbf1891c6e6e51fd33ca9
SHA512 d80a525afcd3729772e2cbb3d69d466e127df9e929a8d757014d2d21b7cc5efe9ddb37926c2c77542cba021c10b2b7f5a2e41f107fe1bda46ec8534c4d1627e9
SSDEEP 384:JZcILsN5g8TZhfzX5od+2d6/Id+2CLmDivruGoj:BLGzOv3lCLmDiDuGc
TLSH
T1B0927D325C686C7749E6F585F94735139FB88067DAC96F8091EC9B2C00DAAEC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7493a19a74a2ee3d4fe8939436003b505ef3d9cdb47fab6a4d918dd0e95ae234
MD5 56f774f9c4434578d0d51bb794335632
SHA1 9ae2db156b4ef0af946dda3ee85e0448811ae3de
SHA512 939f37f50aeec07d149ec7d7daa73f4c25dec34169ba379255c072a6bcb028348d42017a5394e2cc270b5f67d81db5578dce96e43dd58ec164ccd0b94c2608f6
SSDEEP 192:yONI61VWQmiUyUMgGX5Obd+j1+FdgX/t/aV3PXU6:yONI6W6gGX5od+2d6/wpXU6
TLSH
T19A02C735A8687C6B8EF2BD49F48777135FA41067EA952B84DAEC1B1C00D769C2347837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e4d4194f2a9c7274042ec524a3b2ae87865af42d969678407f95ef2f2a0ef8e
MD5 8cfe6ddc3b4a68ab1441d67f38559208
SHA1 a2608c9c3e4e436fc9302e1fe317584aa447b579
SHA512 4749c33f00637aac5f1198f1ea33bfc2777e2dcf31417b405b03f70d257f44201c6be699ceeeb8ef02e260a6644145fd5e4d6ba8c1fc93775617a1ce6f50c36c
SSDEEP 192:hONk61wWQmiUyLM9GX5Obd+j1+FdgX/oxFd+2CL9jJ2QqSU6:hONk6pf9GX5od+2d6/Id+2CLvDU6
TLSH
T1D0120931A468AC278EE2B955F48735138FA55167EE897FC0D5EC2B1C00DBAAC134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 25c53c391045ad1ef697787b1d8f4a6139791dcd5345327f97bbaf23c8a611eb
MD5 3d554810f788ea6c5b07219184fc508e
SHA1 43024a0ea8e0f68be4032b725bad901dc2c07a85
SHA512 c81aca473d85fffee8e4ef4dd25b228a2bd02b2e7aac3478017af0be3ea2d118489a56e5387a51b5bbdccbf5be29030952999c66d5f1a19cd99f8cecc4babc6a
SSDEEP 384:wiFNZcIjsNk8TUNTUlIlg8TZ9fzX5od+2d6/Id+2CLcDivruGoj:LFVjTwgDzOv3lCLcDiDuGc
TLSH
T10CC21AF248D79836D9ADA743E77E2D038EBCC063B5856A80B3D8961CCC565BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1be0d28c-6a7b-45b4-bbb4-8b5e1c30e69d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1be0d28c-6a7b-45b4-bbb4-8b5e1c30e69d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f997f7bf544e30e4aa4af4c4937b04d9c2ab44f9b88a41181eb782f92cd83b19
MD5 59fab865ac70a4383f727a83b16778ba
SHA1 04d5bf1fe34e95010b6d677a6d6e5684dec26579
SHA512 05721ad92a40ae16946713dad9c53153bef45d1fe69e1a05d6c9ef73dd06787bd81c487775208b0ddb04fc909a59f3e5bbb7e5a515b266e738be18597458f797
TLSH
T1CC413B58B7FA1148B3B76F16ABF7A86E487FBD672E06845D10010E4F0663B40D862B37
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
TLSH
T170334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download