8596322722d45320e0f91307655b08c8a8db1e1642fcab7e6e311b1991456b02

Analysis

max time kernel
900s
max time network
874s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 21:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Brutal_Box_0.9.7_WIN10 (1).exe
Size 65.6MB
Sample260828-1k8hyaec27
SHA256 8596322722d45320e0f91307655b08c8a8db1e1642fcab7e6e311b1991456b02
MD5 2a9dc7089cf7c41e73212ff436ad3593
SHA1 226a4f50b010eb5f3c50b21e5d69b9729acd714b
SHA512 ae32822af9d20988f392cec75a5d0e31bf1341f69f2b16f30f55b6661cbfaee71679499c05cb56df562da4d085f143ecfff924a49d539101a48f8e941785472e
SSDEEP 1572864:7wugrMW3M8vDEXm2SWsz84uqDFufVOHJU6:0vAW3vBMQ0V
TLSH
T115E73371A9A1047AF46B837549A70641FE307C032712D7CB3E9CA3642FB76D05BBAB85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Brutal_Box_0.9.7_WIN10 (1).exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
30	raw.githubusercontent.com
31	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1339100942\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1339100942\Sigma\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1855901850\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1723189851\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_205116766\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1060212923\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1339100942\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1339100942\Mu\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_991707415\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_205116766\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1339100942\Mu\CompatExceptions	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1170880356\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1339100942\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1339100942\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1339100942\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1339100942\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1723189851\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_715882937\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_715882937\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_715882937\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1339100942\Sigma\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_715882937\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1339100942\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_52098619\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1170880356\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_818392225\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1855901850\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1339100942\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1060212923\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1855901850\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_715882937\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1339100942\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_715882937\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_715882937\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1339100942\Sigma\Other	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-ml.hyb	msedgewebview2.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{D2D301BF-89C4-4A6D-BB11-BD011743FE7A}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{D8CF728D-7800-45A3-BEC4-C9866936B291}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4396	msedgewebview2.exe
4396	msedgewebview2.exe
5096	explorer.exe
5096	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1944	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe
Token: SeShutdownPrivilege	5096	explorer.exe
Token: SeCreatePagefilePrivilege	5096	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
4264	sihost.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe
5096	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4556	SearchHost.exe
5940	StartMenuExperienceHost.exe
5096	explorer.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 1944	6112	Brutal_Box_0.9.7_WIN10 (1).exe	89
PID 1944 wrote to memory of 5720	1944	msedgewebview2.exe	90
PID 1944 wrote to memory of 2708	1944	msedgewebview2.exe	91
PID 1944 wrote to memory of 2708	1944	msedgewebview2.exe	91
PID 1944 wrote to memory of 2708	1944	msedgewebview2.exe	91
PID 1944 wrote to memory of 2708	1944	msedgewebview2.exe	91
PID 1944 wrote to memory of 3440	1944	msedgewebview2.exe	92
PID 1944 wrote to memory of 1116	1944	msedgewebview2.exe	93
PID 1944 wrote to memory of 1116	1944	msedgewebview2.exe	93
PID 1944 wrote to memory of 1116	1944	msedgewebview2.exe	93
PID 1944 wrote to memory of 5608	1944	msedgewebview2.exe	94
PID 1944 wrote to memory of 5608	1944	msedgewebview2.exe	94
PID 1944 wrote to memory of 5608	1944	msedgewebview2.exe	94
PID 1944 wrote to memory of 5608	1944	msedgewebview2.exe	94
PID 1944 wrote to memory of 5608	1944	msedgewebview2.exe	94
PID 1944 wrote to memory of 1588	1944	msedgewebview2.exe	95
PID 1944 wrote to memory of 1588	1944	msedgewebview2.exe	95
PID 1944 wrote to memory of 1588	1944	msedgewebview2.exe	95
PID 1944 wrote to memory of 1288	1944	msedgewebview2.exe	99
PID 1944 wrote to memory of 1288	1944	msedgewebview2.exe	99
PID 1944 wrote to memory of 1288	1944	msedgewebview2.exe	99
PID 1944 wrote to memory of 4704	1944	msedgewebview2.exe	100
PID 1944 wrote to memory of 4704	1944	msedgewebview2.exe	100
PID 1944 wrote to memory of 4704	1944	msedgewebview2.exe	100
PID 1944 wrote to memory of 4396	1944	msedgewebview2.exe	101
PID 1944 wrote to memory of 4576	1944	msedgewebview2.exe	102
PID 1944 wrote to memory of 4576	1944	msedgewebview2.exe	102
PID 1944 wrote to memory of 4576	1944	msedgewebview2.exe	102
PID 1944 wrote to memory of 1556	1944	msedgewebview2.exe	103
PID 1944 wrote to memory of 1556	1944	msedgewebview2.exe	103
PID 1944 wrote to memory of 1556	1944	msedgewebview2.exe	103
PID 1944 wrote to memory of 6136	1944	msedgewebview2.exe	104
PID 1944 wrote to memory of 6136	1944	msedgewebview2.exe	104
PID 1944 wrote to memory of 6136	1944	msedgewebview2.exe	104
PID 1944 wrote to memory of 5080	1944	msedgewebview2.exe	105
PID 1944 wrote to memory of 5080	1944	msedgewebview2.exe	105
PID 1944 wrote to memory of 5080	1944	msedgewebview2.exe	105
PID 1944 wrote to memory of 4632	1944	msedgewebview2.exe	106
PID 1944 wrote to memory of 4632	1944	msedgewebview2.exe	106
PID 1944 wrote to memory of 4632	1944	msedgewebview2.exe	106
PID 4264 wrote to memory of 5096	4264	sihost.exe	112
PID 1944 wrote to memory of 4520	1944	msedgewebview2.exe	119
PID 1944 wrote to memory of 4520	1944	msedgewebview2.exe	119
PID 1944 wrote to memory of 4520	1944	msedgewebview2.exe	119
PID 1944 wrote to memory of 6132	1944	msedgewebview2.exe	120
PID 1944 wrote to memory of 6132	1944	msedgewebview2.exe	120
PID 1944 wrote to memory of 6132	1944	msedgewebview2.exe	120
PID 1944 wrote to memory of 2556	1944	msedgewebview2.exe	121
PID 1944 wrote to memory of 2556	1944	msedgewebview2.exe	121
PID 1944 wrote to memory of 2556	1944	msedgewebview2.exe	121
PID 1944 wrote to memory of 5228	1944	msedgewebview2.exe	126
PID 1944 wrote to memory of 5228	1944	msedgewebview2.exe	126
PID 1944 wrote to memory of 5228	1944	msedgewebview2.exe	126
PID 1944 wrote to memory of 3816	1944	msedgewebview2.exe	127
PID 1944 wrote to memory of 3816	1944	msedgewebview2.exe	127
PID 1944 wrote to memory of 3816	1944	msedgewebview2.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Brutal_Box_0.9.7_WIN10 (1).exe
"C:\Users\Admin\AppData\Local\Temp\Brutal_Box_0.9.7_WIN10 (1).exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=6112.4188.14162590032285778708 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" /prefetch:4 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe98965fd8,0x7ffe98965fe4,0x7ffe98965ff0
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:2708
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2204 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:1116
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3532 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b /prefetch:1
    3⤵
    PID:5608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4236 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4812 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4780 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4396
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4780 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1048 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:1556
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4992 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:6136
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4320 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:5080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4812 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=5104 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=5024 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:6132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4900 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4984 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView" --webview-exe-name="Brutal_Box_0.9.7_WIN10 (1).exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4320 --field-trial-handle=1780,i,2961106703843278242,4186530965505307063,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1ffba48c5dbef006f55eb922b423dcd85737be5b
    3⤵
    PID:3816

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5096

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5940

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4600

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 33d8ac45512f958d54429d954f876ab613ddd191a17f606b983d18525c39abff
MD5 07db46f32797e3c15eb9adfeffa4c6b8
SHA1 45975850dc138d6d292605fbb055331ac139ea1d
SHA512 6419eb4831dc9b694b4da13ab54f70d05cbd73be3b1e0daba9e04e8321c1d7d65e1e70a7bef44339a32ca385a7781cc490d5c9a5ea125f06ce53babd98fafc24
TLSH
T15DD01222328101B4C43025370402620C0540D91B400680009C29852D3E080584A028D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1f0fdd1bee37965c17895df4e5d32cf60b58050cf289a64d03ed70886705925e
MD5 b9bbd4deb383ce15fe951c4c9265838f
SHA1 1e78ea938a3bf0ea72eedcf74734a23bcf7ae946
SHA512 3b4ee1761c11dc6741ec4903ca5ffa68435c1505ff1815d1408a1466d9d331287967ca51baab7a6d89a581a6b964e38489e84cb9acf05bc803aa1344b95c9ae4
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 ee80b96fd32bb2a9dc365aa4cd30263d4792112255725c700fb538d001a2fa53
MD5 f8ab85774377610865de11785612affa
SHA1 dcd8116b9d739714f6ea8efa46159e5c2d9d90a6
SHA512 6a119fee6c6264f29ed976c58143b73e6105237921d28035eec06f45f242f298c5e672f9058b1edd86a7e514e6180504a2e52098a39ddea386ab9dcfdb1e4ce4
TLSH
T18FD08C04C38EC210CFC0CEF800D74083BAFBE82AEB9BCE21006080347646783325E619
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5998ac.TMP

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5998ac.TMP
Size 48B
SHA256 8c822e6fdcc770f15200b12c1290e70e02f15e7e27846854c2ff72d0ba980f6b
MD5 b30e280385a9a223e489abf668165182
SHA1 47254a60493ed8c4878c5aabc071580bd806da72
SHA512 4c9a9d3f8cb1fa23aa6c7e7b3cf03328ee83fd538b6e41df9ef9053cb6f2c325b38911770844de2a3598fd6a5c369f46bb476e69e0fca8fa2f5bdb096bbb1984
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Default\Network\Network Persistent State
Size 993B
SHA256 6743834a04aab859a6728fd3f9a48a4f63ffea19f03fd7baebe24bf45f3da274
MD5 cd697b88555fea4e4c9cc214aec315ca
SHA1 84aa5db3a49c8a7a4f79e3af4777aaee4c31b1ce
SHA512 fdf62d17c8b5274cf899e91c435a7266c0705a69f14c17a079f746edaa9f1f6ec7473f25cb890e9200b6c92b7f63d79ef837d3dacc524fd35e3cc3f001ed1b1a
TLSH
T157118CF182F4857E895502F46638382BED2F4074862C3925C5D1AFDBC3D1821E214A4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a45e4.TMP

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5a45e4.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 6bc435fb74da6f21c66f4b52d18e788aa941ca8be1fa7f96c4bffc7983699621
MD5 e3846094978f952d51698c67a6baa9d5
SHA1 49568e231827d17b550f2e6d1557b3d6dd6656af
SHA512 66cc9e5d0224b691371f4716bf8159ceb3fc205af3b4a04dc9fb924d799f88de3e77d5f44bca97e6f6694cd67c96712fbc9d67cf604b8ff4363e729bf9f7dadd
TLSH
T1A3F05977C7ADF43B10EC49EB0C44BD417ABAF4354889B8E8CA62D63DF0455E72606403
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59c4bd.TMP

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Default\Network\TransportSecurity~RFe59c4bd.TMP
Size 355B
SHA256 ba765a40596671a6ba17cb7fcfc5b8fccef113a53bf43cc0d57fa71fb7333753
MD5 7167e75b5a7e62a7f2ead4c83f8af3d5
SHA1 ce419d8e6097585130996998dfc0864fb6124e45
SHA512 1e3db040800273c50378472d5107da50bb7ddd5dfc903404a822423f8c2760b752ebbdfb3b9e45e5079bcde8fdaf5c4b70074f4d1763b1806ce028d068dc04dc
TLSH
T1C8E02673C6FDF47720BC49EB0C84FD41BBB6B4394985A8E98A62862DE0605F36507413
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 d03914d057b5818e23d6d4b5afc74de53fd3504e6cb07a3774597013e264872b
MD5 f1bec53af0d628715cd23e7237112b75
SHA1 0c7d0c460b052c73ce8ee906c1fb3075ced974b1
SHA512 1555418ec4c186aeb30e14d1c78cb4514c2675fc9f4de035d914589cfd3377691fe9db655896c31192c2bfbe3104289eca824584489dd19c1f52c09025d8a843
SSDEEP 96:stT/dMuBFdb9Xkpo5h16Zb1s7/x+6Mhmuec1pn1ejerK+gR1G28XM1C7K:stLOuf4oK1sV+FJpnQjZ0G6K
TLSH
T12BD1B6065E24687B4CC6E209FB29BB13E3FA6172A4D41E48E7F8462C04DB6DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 6cfcd65519ad451352479a3d1d173e42f9c7e9405c037d2ce20f16dc9c7fdaf3
MD5 c988bb8b6306eedd6a5d7436f00b1c90
SHA1 e0cc3fb5ad2a6bdb1a8c02d7b9ac5da40fcc238c
SHA512 f32c354a43803727ee9dee3acc5f8e7a4141d01d85c4759083bb8ce1ea2f059e1d9ab8423d2e184bc3b826c126d07ca710d9775f8d8dfc96c4e8e8dcff484c53
SSDEEP 96:stT/dMuBMGdb9Xkpo5h16Zb1s7/x+6Mhmuec1pn1ejerK+gR1G28XM1C7K:stLOuV4oK1sV+FJpnQjZ0G6K
TLSH
T1E8D1A7065A24787B4CC6E209FB29BB13E3FA5172A5D41E58E7F8462C04DB6DC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b2c9d245-7ed6-4302-9910-bb87b849f789.tmp

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Default\b2c9d245-7ed6-4302-9910-bb87b849f789.tmp
Size 5KB
SHA256 d6eb85cbf9802092b509e515a757427ccb5d52ce5d91e4e27ec7860c7d898d3c
MD5 7868ba62b0fd33c385854ac4677f319b
SHA1 dd974df01d200bf37aa20edcd040ea7c305946ca
SHA512 97490ff251890543c0abee89313b5e2eb72183a84de82d47f8679b9d49badd51e18c182365ef2a00b7eef44ea456f4940c1cd381199e498e8f7c28aff09188ad
SSDEEP 96:rT/dMuBFdb9Xk1do616Zb1s7/x+6Mhmuec1pn1ejerK+gReT28XM1C7K:rLOufUoV1sV+FJpnQjZUG6K
TLSH
T10DC1C8065A24697B4CC6E209FB297B13E3FA5172B4D51D18E7F88A2C04DB6CC631BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Local State
Size 3KB
SHA256 d85d0196a9f8c940597a7a95285640c76eb607788ccade0fb70bf8e704c530d7
MD5 b2fd968a4fb7220e6cf7d4af63cce2ae
SHA1 5b25ef96c74af009be3a3d86080b26543ad712d0
SHA512 3c43c809d09c0b2f0012ba3ca747dd187543b2f0fd269dfd9e5bd4e599e52b3db87f531c20f76c6df63f2eb7ebcae231b98af6017a0e444562b0eb757ac81331
TLSH
T149719533A974AA2B4DF2DA05B9862B13BB725133E5853F99C9EC0F0D41D73890386C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Local State
Size 2KB
SHA256 e8fb6b48842312525c261b9020db66fd9ec6ce0fbde8dd243b5049ea3f1ab7b7
MD5 51cfd5c1d971c87f08a2dde527e7e52b
SHA1 87b567f57357d7bb3517a2400b1d480c550dd959
SHA512 dfd74baa20c0b0bdc9fc6dab8fb8def8c66741a7d9392b5b11aa5802819b2c45954713e6b82f59a4010226ffb180a0f73bf473542a6ac4e927f4fdb55e0ad12a
TLSH
T1B0517433A825AB3B89F29A45BA472B139F775172EA522F1099EC0B1C41D735C138AC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Local State
Size 3KB
SHA256 6a098935faa605ffcaf8ea478ec025ccb60509d1e04d088972ecf2ee62ea21e1
MD5 8034abdcf90a0af5f04d4942a4c1ada4
SHA1 2307e7a8aa830dc0995ceec0eb1fca5325b0737b
SHA512 342c58f6ea2958b7e32cea02440d1224f0b38d9bd095de45a03721d595a6222ec64d90303b3e1e3c14c9cdb6afb42e5e1328dfd7e263832ccf0584c86f9e85e2
TLSH
T12C618533A974AA3B4EF29A01B9862B17BBB65133E5913F55C5EC0F0C01D73881382C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Local State
Size 16KB
SHA256 c59665e6a3e7fc8188f548a900f19ac76413fe52cf71d6fcf4975e4be8fdb558
MD5 49a323111007203f794166cdfe6d0c79
SHA1 fdf057d0864dfc514ef082b13872c9459a9a38b5
SHA512 3419e8986f17f78a166d6775a1cb68d9f44df4de0234a12c657c328c745ebeb77eb32a8b271db745b596771d9ca0a834d77295ce85b89fcc51f3fe77def06d6b
SSDEEP 384:z+aQikB+z/xvxjg/qhEwNBSzVvKBC+25AMAVdp4M9zF:S/UxvxjgC+LlVb5AMUNFF
TLSH
T16A729D37D82AAF27A8F3A7417A0A578BCBB5457251C12AE84DE95F0D06C33ED0306C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe592dec.TMP

Path C:\Users\Admin\AppData\Local\Brutal Box\WebView2\EBWebView\Local State~RFe592dec.TMP
Size 1KB
SHA256 26239ea9e16a7d94dab54e28604febcd67b8128e4ba1f507def7c5cd44e15d71
MD5 ac9c54d274a926ca0660064ccbfba104
SHA1 5fdc981c29fcf6fd4eac51cfa4c39a79be3c6f8c
SHA512 2f157e16cc26626db96aaaf4d05a78925af0d445daefab579d7fc2140851c26e85f65073f60b4529210fdc1fd583acfa77872f59a8c55b81400e6ea51401c640
TLSH
T1B92140B3E8756B3A8D926643765227176F335177C2115F00A5EC0B1D42E734C92AA837
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

Other

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_1339100942\Mu\Other
Size 34B
SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
MD5 cd0395742b85e2b669eaec1d5f15b65b
SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
MD5 SHA1 SHA512

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1944_637132490\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2708-215-0x0000022C67B70000-0x0000022C67B73000-memory.dmp

Download

memory/2708-235-0x0000022C67C30000-0x0000022C67C48000-memory.dmp

Download

memory/2708-198-0x0000022C67AF0000-0x0000022C67AF8000-memory.dmp

Download

memory/2708-200-0x0000022C67B10000-0x0000022C67B12000-memory.dmp

Download

memory/2708-203-0x0000022C67B00000-0x0000022C67B07000-memory.dmp

Download

memory/2708-202-0x0000022C67B20000-0x0000022C67B24000-memory.dmp

Download

memory/2708-197-0x0000022C67B00000-0x0000022C67B04000-memory.dmp

Download

memory/2708-204-0x0000022C67B20000-0x0000022C67B21000-memory.dmp

Download

memory/2708-210-0x0000022C67B30000-0x0000022C67B34000-memory.dmp

Download

memory/2708-209-0x0000022C67B40000-0x0000022C67B42000-memory.dmp

Download

memory/2708-207-0x0000022C67B50000-0x0000022C67B61000-memory.dmp

Download

memory/2708-206-0x0000022C67B40000-0x0000022C67B49000-memory.dmp

Download

memory/2708-212-0x0000022C67B70000-0x0000022C67B7B000-memory.dmp

Download

memory/2708-213-0x0000022C67B80000-0x0000022C67B96000-memory.dmp

Download

memory/2708-217-0x0000022C67B70000-0x0000022C67B71000-memory.dmp

Download

memory/2708-216-0x0000022C67B40000-0x0000022C67B45000-memory.dmp

Download

memory/2708-167-0x0000022C67950000-0x0000022C67952000-memory.dmp

Download

memory/2708-220-0x0000022C67BA0000-0x0000022C67BAF000-memory.dmp

Download

memory/2708-223-0x0000022C67BB0000-0x0000022C67BB4000-memory.dmp

Download

memory/2708-222-0x0000022C67BC0000-0x0000022C67BC2000-memory.dmp

Download

memory/2708-219-0x0000022C67BB0000-0x0000022C67BB8000-memory.dmp

Download

memory/2708-226-0x0000022C67BE0000-0x0000022C67BF6000-memory.dmp

Download

memory/2708-225-0x0000022C67BD0000-0x0000022C67BDB000-memory.dmp

Download

memory/2708-232-0x0000022C67BC0000-0x0000022C67BC4000-memory.dmp

Download

memory/2708-243-0x0000022C67C70000-0x0000022C67C7B000-memory.dmp

Download

memory/2708-244-0x0000022C67C80000-0x0000022C67C96000-memory.dmp

Download

memory/2708-234-0x0000022C67C20000-0x0000022C67C2C000-memory.dmp

Download

memory/2708-241-0x0000022C67BD0000-0x0000022C67BD4000-memory.dmp

Download

memory/2708-240-0x0000022C67C20000-0x0000022C67C22000-memory.dmp

Download

memory/2708-238-0x0000022C67C50000-0x0000022C67C61000-memory.dmp

Download

memory/2708-237-0x0000022C67C20000-0x0000022C67C29000-memory.dmp

Download

memory/2708-166-0x0000022C67940000-0x0000022C67941000-memory.dmp

Download

memory/2708-231-0x0000022C67BD0000-0x0000022C67BD2000-memory.dmp

Download

memory/2708-229-0x0000022C67C00000-0x0000022C67C12000-memory.dmp

Download

memory/2708-228-0x0000022C67BD0000-0x0000022C67BD9000-memory.dmp

Download

memory/2708-247-0x0000022C67C20000-0x0000022C67C28000-memory.dmp

Download

memory/2708-246-0x0000022C67C70000-0x0000022C67C74000-memory.dmp

Download

memory/2708-250-0x0000022C67C70000-0x0000022C67C78000-memory.dmp

Download

memory/2708-249-0x0000022C67CA0000-0x0000022C67CA4000-memory.dmp

Download

memory/2708-253-0x0000022C67CA0000-0x0000022C67CA6000-memory.dmp

Download

memory/2708-262-0x0000022C67CD0000-0x0000022C67CD4000-memory.dmp

Download

memory/2708-259-0x0000022C67CC0000-0x0000022C67CC8000-memory.dmp

Download

memory/2708-258-0x0000022C67CD0000-0x0000022C67CD4000-memory.dmp

Download

memory/2708-252-0x0000022C67CB0000-0x0000022C67CB3000-memory.dmp

Download

memory/2708-261-0x0000022C67CE0000-0x0000022C67CE2000-memory.dmp

Download

memory/2708-256-0x0000022C67CB0000-0x0000022C67CB4000-memory.dmp

Download

memory/2708-255-0x0000022C67CC0000-0x0000022C67CC2000-memory.dmp

Download

memory/2708-264-0x0000022C67CF0000-0x0000022C67CF4000-memory.dmp

Download

memory/2708-169-0x0000022C67A60000-0x0000022C67A63000-memory.dmp

Download

memory/2708-170-0x0000022C67940000-0x0000022C67946000-memory.dmp

Download

memory/2708-174-0x0000022C67AA0000-0x0000022C67AA2000-memory.dmp

Download

memory/2708-172-0x0000022C67A90000-0x0000022C67A92000-memory.dmp

Download

memory/2708-175-0x0000022C67A60000-0x0000022C67A64000-memory.dmp

Download

memory/2708-178-0x0000022C67AA0000-0x0000022C67AA8000-memory.dmp

Download

memory/2708-180-0x0000022C67AC0000-0x0000022C67AC2000-memory.dmp

Download

memory/2708-181-0x0000022C67AB0000-0x0000022C67AB4000-memory.dmp

Download

memory/2708-185-0x0000022C67AD0000-0x0000022C67AD4000-memory.dmp

Download

memory/2708-186-0x0000022C67AC0000-0x0000022C67AC8000-memory.dmp

Download

memory/2708-188-0x0000022C67AE0000-0x0000022C67AE2000-memory.dmp

Download

memory/2708-190-0x0000022C67AF0000-0x0000022C67AF2000-memory.dmp

Download

memory/2708-191-0x0000022C67AD0000-0x0000022C67AD4000-memory.dmp

Download

memory/2708-177-0x0000022C67AB0000-0x0000022C67AB4000-memory.dmp

Download

memory/2708-26-0x00007FFEB8B80000-0x00007FFEB8B81000-memory.dmp

Download

memory/5608-103-0x00007FFEB8B80000-0x00007FFEB8B81000-memory.dmp

Download