hxxps://motu[.]com/products/software/electrickeys/downloads/

Resubmissions

15/10/2026, 13:59

261015-raq2gaxta18

15/10/2026, 13:53

261015-q7e5ss1y6k3

Analysis

user interaction
yes
max time kernel
195s
max time network
196s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://motu.com/products/software/electrickeys/downloads/
Sample261015-raq2gaxta1

Score

8^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
86	5876	msedge.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 7 IoCs

pid	Process
5780	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).exe
4264	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
4944	MOTUMSeries.exe
2284	MSeriesDriverUtil.exe
4892	ndp48-web.exe
4572	Setup.exe
1436	MOTUCoreUACAudioPolicyMediator.exe

Loads dropped DLL 3 IoCs

pid	Process
4944	MOTUMSeries.exe
4572	Setup.exe
4572	Setup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MOTUMSeries.exe = "C:\\Program Files (x86)\\MOTU\\CoreUAC\\MOTUMSeries.exe"	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\motucoreuac.inf_amd64_822d6a50f76f42aa.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{5cfe2d2e-267b-f043-951c-82ce028b79d9}\SET9353.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cee9a67f-9deb-ab41-ae01-cb49faecd001}\SET8EDF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cee9a67f-9deb-ab41-ae01-cb49faecd001}\SET8EE0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\motucoreuac.inf_amd64_822d6a50f76f42aa\MOTUCoreUAC.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cee9a67f-9deb-ab41-ae01-cb49faecd001}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5cfe2d2e-267b-f043-951c-82ce028b79d9}\SET9354.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5cfe2d2e-267b-f043-951c-82ce028b79d9}\MOTUMSeriesUpdate.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\motumseriesupdate.inf_amd64_32bae345c380de15\MOTUMSeriesUpdate.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\motumseriesupdate.inf_amd64_32bae345c380de15\motumseriesupdate.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{cee9a67f-9deb-ab41-ae01-cb49faecd001}\SET8EDF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cee9a67f-9deb-ab41-ae01-cb49faecd001}\motucoreuac.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5cfe2d2e-267b-f043-951c-82ce028b79d9}\SET9353.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\motumseriesupdate.inf_amd64_32bae345c380de15.ini	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5cfe2d2e-267b-f043-951c-82ce028b79d9}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{cee9a67f-9deb-ab41-ae01-cb49faecd001}\SET8EE0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cee9a67f-9deb-ab41-ae01-cb49faecd001}\MOTUCoreUAC.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{cee9a67f-9deb-ab41-ae01-cb49faecd001}\SET8EE1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\motucoreuac.inf_amd64_822d6a50f76f42aa\MOTUCoreUAC.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\motucoreuac.inf_amd64_822d6a50f76f42aa\motucoreuac.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{5cfe2d2e-267b-f043-951c-82ce028b79d9}\motumseriesupdate.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{5cfe2d2e-267b-f043-951c-82ce028b79d9}\SET9354.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cee9a67f-9deb-ab41-ae01-cb49faecd001}\SET8EE1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cee9a67f-9deb-ab41-ae01-cb49faecd001}\MOTUCoreUAC.sys	DrvInst.exe

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages\is-71A3L.tmp	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File opened for modification	C:\Program Files (x86)\MOTU\CoreUAC\x64\MOTUCoreUACASIO.dll	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File opened for modification	C:\Program Files (x86)\MOTU\CoreUAC\x86\MOTUCoreUACASIO.dll	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File created	C:\Program Files (x86)\MOTU\CoreUAC\x86\is-MSSJ0.tmp	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File created	C:\Program Files (x86)\MOTU\CoreUAC\Service\is-DDDQS.tmp	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File created	C:\Program Files (x86)\MOTU\CoreUAC\Redistributables\is-QLT6J.tmp	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File created	C:\Program Files (x86)\MOTU\CoreUAC\unins000.msg	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File opened for modification	C:\Program Files (x86)\MOTU\CoreUAC\unins000.dat	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File opened for modification	C:\Program Files (x86)\MOTU\CoreUAC\Service\MOTUCoreUACAudioPolicyMediator.exe	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File created	C:\Program Files (x86)\MOTU\CoreUAC\is-7P0B1.tmp	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File opened for modification	C:\Program Files (x86)\MOTU\CoreUAC\MOTUMSeries.exe	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File opened for modification	C:\Program Files (x86)\MOTU\CoreUAC\MSeriesLib.dll	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File created	C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages\is-L9OBS.tmp	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File created	C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages\is-EUNJ5.tmp	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File created	C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages\is-SJJCT.tmp	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File created	C:\Program Files (x86)\MOTU\CoreUAC\is-LAIJP.tmp	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File opened for modification	C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages\MSeriesDriverUtil.exe	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File opened for modification	C:\Program Files (x86)\MOTU\CoreUAC\Redistributables\ndp48-web.exe	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File created	C:\Program Files (x86)\MOTU\CoreUAC\unins000.dat	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File created	C:\Program Files (x86)\MOTU\CoreUAC\is-V1MNN.tmp	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File created	C:\Program Files (x86)\MOTU\CoreUAC\x64\is-D2PLO.tmp	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File created	C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages\is-KOI6O.tmp	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
File created	C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages\is-QDOMP.tmp	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\inf\oem2.inf	DrvInst.exe
File created	C:\Windows\INF\oem0.PNF	MSeriesDriverUtil.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\inf\oem2.inf	DrvInst.exe
File created	C:\Windows\INF\oem1.PNF	MSeriesDriverUtil.exe
File created	C:\Windows\INF\oem2.PNF	MSeriesDriverUtil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3488	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MOTUMSeries.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MOTUMSeries.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MOTUMSeries.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ndp48-web.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5876	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x000600000001877c-453.dat	innosetup
behavioral1/memory/5780-488-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup
behavioral1/memory/5780-577-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup
behavioral1/memory/5780-899-0x0000000000400000-0x00000000004CC000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MSeriesDriverUtil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	MSeriesDriverUtil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	MSeriesDriverUtil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MSeriesDriverUtil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MSeriesDriverUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	MSeriesDriverUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	MSeriesDriverUtil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	MSeriesDriverUtil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MSeriesDriverUtil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MSeriesDriverUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	pnputil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	MSeriesDriverUtil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	pnputil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	pnputil.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
948	NETSTAT.EXE
3172	NETSTAT.EXE
2756	NETSTAT.EXE
2980	NETSTAT.EXE

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
1436	taskkill.exe
1244	taskkill.exe
6020	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe

Modifies registry class 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3E08EBEA-46E3-45B9-8216-312892B30F94}\InProcServer32\ThreadingModel = "Apartment"	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E08EBEA-46E3-45B9-8216-312892B30F94}\InProcServer32\ = "C:\\Program Files (x86)\\MOTU\\CoreUAC\\x86\\MOTUCoreUACASIO.dll"	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3E08EBEA-46E3-45B9-8216-312892B30F94}	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E08EBEA-46E3-45B9-8216-312892B30F94}\InProcServer32\ThreadingModel = "Apartment"	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3E08EBEA-46E3-45B9-8216-312892B30F94}\ = "MOTU M Series"	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{B2CB96A3-4A22-456E-A29D-4F6583F135A3}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E08EBEA-46E3-45B9-8216-312892B30F94}\ = "MOTU M Series"	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E08EBEA-46E3-45B9-8216-312892B30F94}\InProcServer32	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3E08EBEA-46E3-45B9-8216-312892B30F94}\InProcServer32	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3E08EBEA-46E3-45B9-8216-312892B30F94}\InProcServer32\ = "C:\\Program Files (x86)\\MOTU\\CoreUAC\\x64\\MOTUCoreUACASIO.dll"	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E08EBEA-46E3-45B9-8216-312892B30F94}	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4264	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
4264	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
4944	MOTUMSeries.exe
4944	MOTUMSeries.exe
4572	Setup.exe
4572	Setup.exe
4572	Setup.exe
4572	Setup.exe
4572	Setup.exe
4572	Setup.exe
4572	Setup.exe
4572	Setup.exe
3024	msedge.exe
3024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1436	taskkill.exe
Token: SeDebugPrivilege	1244	taskkill.exe
Token: SeDebugPrivilege	6020	taskkill.exe
Token: SeDebugPrivilege	4944	MOTUMSeries.exe
Token: SeDebugPrivilege	2980	NETSTAT.EXE

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
4264	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
4944	MOTUMSeries.exe

Suspicious use of SendNotifyMessage 17 IoCs

pid	Process
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
1268	msedge.exe
4944	MOTUMSeries.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 5804	1268	msedge.exe	90
PID 1268 wrote to memory of 3444	1268	msedge.exe	91
PID 1268 wrote to memory of 5876	1268	msedge.exe	92
PID 1268 wrote to memory of 3444	1268	msedge.exe	91
PID 1268 wrote to memory of 3444	1268	msedge.exe	91
PID 1268 wrote to memory of 3304	1268	msedge.exe	94
PID 1268 wrote to memory of 3304	1268	msedge.exe	94
PID 1268 wrote to memory of 3924	1268	msedge.exe	95
PID 1268 wrote to memory of 3924	1268	msedge.exe	95
PID 1268 wrote to memory of 3924	1268	msedge.exe	95
PID 1268 wrote to memory of 1512	1268	msedge.exe	96
PID 1268 wrote to memory of 1512	1268	msedge.exe	96
PID 1268 wrote to memory of 1512	1268	msedge.exe	96
PID 1268 wrote to memory of 956	1268	msedge.exe	97
PID 1268 wrote to memory of 956	1268	msedge.exe	97
PID 1268 wrote to memory of 956	1268	msedge.exe	97
PID 1268 wrote to memory of 5828	1268	msedge.exe	98
PID 1268 wrote to memory of 5828	1268	msedge.exe	98
PID 1268 wrote to memory of 5828	1268	msedge.exe	98
PID 1268 wrote to memory of 5628	1268	msedge.exe	100
PID 1268 wrote to memory of 5628	1268	msedge.exe	100
PID 1268 wrote to memory of 796	1268	msedge.exe	101
PID 1268 wrote to memory of 796	1268	msedge.exe	101
PID 1268 wrote to memory of 2816	1268	msedge.exe	103
PID 1268 wrote to memory of 3588	1268	msedge.exe	107
PID 1268 wrote to memory of 5524	1268	msedge.exe	108
PID 1268 wrote to memory of 3120	1268	msedge.exe	109
PID 1268 wrote to memory of 2292	1268	msedge.exe	110
PID 1268 wrote to memory of 2292	1268	msedge.exe	110
PID 1268 wrote to memory of 3084	1268	msedge.exe	112
PID 1268 wrote to memory of 3084	1268	msedge.exe	112
PID 1268 wrote to memory of 1980	1268	msedge.exe	113
PID 1268 wrote to memory of 1980	1268	msedge.exe	113
PID 1268 wrote to memory of 1980	1268	msedge.exe	113
PID 1268 wrote to memory of 5116	1268	msedge.exe	114
PID 1268 wrote to memory of 6004	1268	msedge.exe	115
PID 1268 wrote to memory of 6004	1268	msedge.exe	115
PID 1268 wrote to memory of 5780	1268	msedge.exe	116
PID 5780 wrote to memory of 4264	5780	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).exe	117
PID 4264 wrote to memory of 1436	4264	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp	137
PID 4264 wrote to memory of 1244	4264	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp	121
PID 4264 wrote to memory of 6020	4264	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp	123
PID 4264 wrote to memory of 3024	4264	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp	140
PID 4264 wrote to memory of 3116	4264	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp	130
PID 4264 wrote to memory of 2284	4264	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp	133
PID 4264 wrote to memory of 4892	4264	MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp	135
PID 4892 wrote to memory of 4572	4892	ndp48-web.exe	136
PID 1268 wrote to memory of 3024	1268	msedge.exe	140
PID 1276 wrote to memory of 948	1276	cmd.exe	141
PID 1276 wrote to memory of 3172	1276	cmd.exe	142
PID 1276 wrote to memory of 2756	1276	cmd.exe	143
PID 2756 wrote to memory of 3488	2756	NETSTAT.EXE	144
PID 3488 wrote to memory of 1828	3488	cmd.exe	145
PID 1276 wrote to memory of 2980	1276	cmd.exe	146
PID 1268 wrote to memory of 4432	1268	msedge.exe	147
PID 1268 wrote to memory of 4432	1268	msedge.exe	147
PID 1268 wrote to memory of 3384	1268	msedge.exe	148
PID 1268 wrote to memory of 3384	1268	msedge.exe	148
PID 1268 wrote to memory of 2784	1268	msedge.exe	149
PID 1268 wrote to memory of 2784	1268	msedge.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://motu.com/products/software/electrickeys/downloads/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ffd6987c188,0x7ffd6987c194,0x7ffd6987c1a0
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,2111998937665027026,15173622210516068662,262144 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,4992604622578423950,5154757699891842209,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,7952374587517157680,5868845740550379434,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:13
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,608204042371962642,3980756344999590967,2097152 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,12986118029592500013,15623741003017635740,2097152 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,11678669524810180835,7093395757832420131,2097152 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,11982792313243083577,12970207484375308116,2097152 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:9
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,9860479287243051368,5834528284542859946,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,4278139718312158707,4846456855572089667,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,14990123108417459051,17010673334944717312,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,14990123108417459051,17010673334944717312,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,13205345645518479442,13714567525146461544,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,10493152198146212201,7147976057303761663,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,3288143216892893356,13235773139527122329,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,61700119857244834,13710541408016396345,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:14
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,7128908511465757705,2702650565845599763,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6672,i,10916602689769295397,3083021614987463989,2097152 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,7185092736607666132,1040570044469458589,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,6631091281766506948,8479958336309783844,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:14
  2⤵
  PID:6004
- C:\Users\Admin\Downloads\MOTU M Series Universal Setup (4.6.0.705+cc30ed084).exe
  "C:\Users\Admin\Downloads\MOTU M Series Universal Setup (4.6.0.705+cc30ed084).exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5780
- - C:\Users\Admin\AppData\Local\Temp\is-RV3JH.tmp\MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
    "C:\Users\Admin\AppData\Local\Temp\is-RV3JH.tmp\MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp" /SL5="$A0112,3971269,781312,C:\Users\Admin\Downloads\MOTU M Series Universal Setup (4.6.0.705+cc30ed084).exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /f /im "MOTUMSeries.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1436
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /f /im "MOTUCoreUACAudioPolicyMediator.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1244
  - - C:\Windows\SYSTEM32\taskkill.exe
      "taskkill.exe" /f /im "MOTUCoreUACAudioPolicyMediator.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6020
  - - C:\Windows\SYSTEM32\pnputil.exe
      "pnputil.exe" /add-driver "C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages\MOTUCoreUAC.inf" /install
      4⤵
      Drops file in Windows directory
      Checks SCSI registry key(s)
      PID:3024
  - - C:\Windows\SYSTEM32\pnputil.exe
      "pnputil.exe" /add-driver "C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages\MOTUMSeriesUpdate.inf" /install
      4⤵
      Drops file in Windows directory
      Checks SCSI registry key(s)
      PID:3116
  - - C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages\MSeriesDriverUtil.exe
      "C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages\MSeriesDriverUtil.exe" upgrade
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Checks SCSI registry key(s)
      PID:2284
  - - C:\Program Files (x86)\MOTU\CoreUAC\Redistributables\ndp48-web.exe
      "C:\Program Files (x86)\MOTU\CoreUAC\Redistributables\ndp48-web.exe" /quiet /AcceptEULA /norestart
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\89710c8eee7e15bbaa2b\Setup.exe
        
        C:\89710c8eee7e15bbaa2b\\Setup.exe /quiet /AcceptEULA /norestart /x86 /x64 /web
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7408,i,15993088736491137072,2342976901848673064,262144 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,3696418568615536975,3528036712320038608,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,16910410701221203799,4387636292937592258,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:14
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7288,i,16139088936858520308,10533981602712238664,524288 --field-trial-handle=2240,i,13503900379623776509,3220884045124813042,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:14
  2⤵
  PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4896

C:\Program Files (x86)\MOTU\CoreUAC\MOTUMSeries.exe
"C:\Program Files (x86)\MOTU\CoreUAC\MOTUMSeries.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4944

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{80e5cf2c-e370-314d-ac27-3a356d17e889}\MOTUCoreUAC.inf" "9" "47cc1cc97" "0000000000000190" "WinSta0\Default" "0000000000000194" "208" "C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2512

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8a062871-f659-d64c-83c0-f5dbf8824846}\MOTUMSeriesUpdate.inf" "9" "4125db46f" "0000000000000194" "WinSta0\Default" "00000000000000EC" "208" "C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4572

C:\Program Files (x86)\MOTU\CoreUAC\Service\MOTUCoreUACAudioPolicyMediator.exe
"C:\Program Files (x86)\MOTU\CoreUAC\Service\MOTUCoreUACAudioPolicyMediator.exe"
1⤵
- Executes dropped EXE
PID:1436

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\system32\NETSTAT.EXE
  netstat /m
  2⤵
  - Gathers network information
  PID:948
- C:\Windows\system32\NETSTAT.EXE
  netstat -m
  2⤵
  - Gathers network information
  PID:3172
- C:\Windows\system32\NETSTAT.EXE
  netstat -r
  2⤵
  - Gathers network information
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3488
  - - C:\Windows\system32\ROUTE.EXE
      C:\Windows\system32\route.exe print
      4⤵
      PID:1828
- C:\Windows\system32\NETSTAT.EXE
  netstat -n
  2⤵
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:2980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1025\LocalizedData.xml
Size 80KB
SHA256 b092668e0825f7f498acdc1bf10e1d2cb6ca99497389142cf9af815f25a4b712
MD5 d8165beb3b8433921d0d5611b85bfa35
SHA1 bef57e3511e18170ebbc9ae3aefd73ce3f50f8f4
SHA512 9fa221f549b4e660c4f40c7ab0e483e3d9a9204248da51675058f32f4f56667c782667295decbb441a581f582a099fe34c6cc569d0c4ec13e85c680abf5870b0
SSDEEP 384:4YPMFNhaVwV/VLVWPD66KUtycONAkwtj7l/XeqyEnmM7cBp9stCctFnDRydTJleD:XlxcdGUTJleYi
TLSH
T13983EB11AEFAA238B0BB9A14EDB381510EF37D915C75C12D00991D4E4AB7FC58E16FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1028\LocalizedData.xml
Size 69KB
SHA256 53742293b25149b19d8677b15f6424fc71e308014b1bcf883e6949d1dab3961c
MD5 f3a4fd6968658a18882cf300553f2f89
SHA1 b75ccaeff41bf9c8586bca612550cb9dca6b09ea
SHA512 9692c8577034c0e628a42d581f634ed174b4af684ee87c947556888027215bbf4c92286a3ad1cb1792fc6f7392190719ebef85b60fce48e20239abcb58d04d97
SSDEEP 384:4YggFNhaVwV/VLV33zqjKUtycONAkrNsc2XcbacaQJETJ9bCHwx+DR+USWV/K1ND:+X7UysBSWV/K1+gwJg5H
TLSH
T1A663A512AEFB2218F0BAAA55BEB700944EF3BDD15C35C11D0099294E8A77FC58D15FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1029\LocalizedData.xml
Size 85KB
SHA256 cbb0da2d1efa7de6736e67c978848d53acf8b502bf3daf43ce40b05076145a7c
MD5 d6801174849373cde3f1d214d80fe834
SHA1 50caf47aa60b999ca7b43d3ceb75d0dbffd2278a
SHA512 a4cf812dc4fac888dad4ca986fcb07b93f45633fe5931f24afff4558d9a29734a0ac5d647f3bc631c377fba816c19bd44178398bb6166f6f84e5f05acb8e0a18
SSDEEP 384:4YQWbTP0qTvLSGf6KUtycONAkkMo+snsMsBTKTuTyTfQjkj/svHov+yJKe3dJTZT:x2LTwiJUQ
TLSH
T15D83A312AEFA2218F1BBAB05BDB700A44EF77D915C35C11E0099198E4A77FC58D25FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1030\LocalizedData.xml
Size 83KB
SHA256 59884541554376a26143b105fa924b9f9961254d22db8dedf7de7f3495d7a1dd
MD5 03b1e582ec5454b2fa3599e788569dfa
SHA1 75845acdd04fb17011218b06fd7c28830641f021
SHA512 23d1b1c2e2c78692a48b959bdb70c3c321a76792885b19805cafd543c0ef25856f8f115af766ea46f20eb2c440eaf31e656726710b12ae5f362779bea28035bc
SSDEEP 384:4Y4UFNhaVwV/VLVWPD66KUtycONAk9iqz3b4VYgkZAEbZfURtzBSmRLAgRQJYR2X:fgkZptSvJcR
TLSH
T1DB836E11AFFA2218F1BBAB15BDB700940EB7BDD19835C11D0099298E8E77FC58925F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1031\LocalizedData.xml
Size 88KB
SHA256 961efe11e9e3e553269cb14dc1b942e9ac68b86740d59aa35e4ff6e5913532dd
MD5 afb4b1d7103ddca43ea723acbcdd31fd
SHA1 c4d95dfd4869df636091e979c8b3bd7684004a48
SHA512 bde563d158e38f7a46abe564e365bbc9cfa235f4735f668a532919f0575bead27bdd6fa11ac50802c989f2f69371c2e9179c9affbc85954a9b4050f9122e26a5
SSDEEP 384:4Yw+ld52odZWPD66KUtycONAkXWc16MsyBABwPlPHCUBjp4RbcNU8oO0GAJGntzI:ga6UBABwPlPxY6VC7u3pg010Jsz/ziX
TLSH
T174939E11AFFA2218F1FAAB54BEB711940EB3BDD19C35C11D0099288E4E77F858925B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1032\LocalizedData.xml
Size 90KB
SHA256 6c5a6e11a85c9e172e7748a9a9f19f8598870a63a103a7ac18cbbd0cdf026475
MD5 71bdb323a746a4adab9ce42498e937bc
SHA1 8e58d4ba5623a50610bd99e82df135708a9f130e
SHA512 b7d66fa4f1a1b7130cdd801447fe0c4965cba1618c01d4ff64b9707e3e132fb13858aa498ea26fb1e54b56daf83e5e7958c6a4fcc1a4ad6dd6c2ffa966e58b76
SSDEEP 384:4Y7yvnT86nzWPD66KUtycONAkY+LoYRONOVA8HTiVEsmXadUkec00CfMMHlRcyvN:MqPQyZ0J7
TLSH
T17E93E6059EFB2314B5BAAAA56DB300940EB7FDC14835C52D10A9384E8E6FF858DD1F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1033\LocalizedData.xml
Size 83KB
SHA256 05fc9352b918a710d51f68873fc522528265455b77014e8b0cd66c5e7aa71dc3
MD5 47703bed025228689a1032edae56b4c4
SHA1 a2aba33c7e8915025251574c81fe2e5ac6bc0893
SHA512 9d6eda9fc3be6116371d1b86b54b8b65ccd58c182105e0954870f75e2a6f4d7e8fc84462bfd3584175c0f849066e47d82cd18ae3bf1671e60cc237347b7cc00d
SSDEEP 384:4gS89tJKVQVfVjV2vjaCS89aEetgcsFTeyfg8NqJpR+enRROu5aeJInO/yJakC62:YeyfJqyJiT
TLSH
T174837F12AFFA2258F1BBAB14BEB710940EB7BD915C35C11D0099188E8A77FC58D25F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1035\LocalizedData.xml
Size 84KB
SHA256 1e828840ae8728ac809624845597406d4025d6da7797b38f02946a30a48bfe7c
MD5 ad67691b3b5474154f65400e53ddfef2
SHA1 dc8dc683bf9fee12a5ab7297789a5c087e98facc
SHA512 64ee113f0c3e173fee6047cc41ff3e84181aba2eb2b02ca5cc717caaf1392e5e2f0eed7e7c469d821d86878443bc8ec64c66e2afb1d850fb4c7e9823c3a5ea73
SSDEEP 384:4Ys04sUwpVbVkV4VbiO/6KUtyc6BM47+QqOYeBzW/jzKdm4Ne4Bti4l59R8fOaJt:Fr/lOfOaJ+Q
TLSH
T1C7836B11AEFA2218F1FBAB15BEB601900EB3BE915C75C11D0099294E8A77FC58D25F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1036\LocalizedData.xml
Size 87KB
SHA256 ab3d5571b57b7bb705bffe13f37bd73894b0d12d09cc1fb1b438493a863c324c
MD5 2c77cbaaf9c3ed0c4410c4b8c3c29c30
SHA1 110775ca1c6e252b4e8c8bf39b593dfb4d66206c
SHA512 c1438b9b95bd16503f5a14d743e9c6c40cb46cd24a4bb48adf6f9162c61e8979c370e7e1eff8989db05ff5a496415a68b58cc16912a7c8215fecb72d252c5285
SSDEEP 384:4YgEF9xWQ9RWPD66KUtycsmIPKCoEVDpFqpRatkxOGv1Gj8VjfRiLYcRryQMuvtR:V+skau8tbxhJNP/J
TLSH
T1CC936D12AFFA2218F1FBAB05BDB710940EB7BD919C35C11D0099298E4E77F858D25B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1037\LocalizedData.xml
Size 78KB
SHA256 e9877973bef23498b586a9cf03230fc45a9ea8a3f75decfa062b03bd31974b06
MD5 631011d665ad08220fe248d9f8a103ba
SHA1 652c56998d0e8bf0c43f136fd90c69728bb0e111
SHA512 cf479c0c5167e011721bd6b0f5829a62c0c269b1e1be13e5bb750516b8441a1d8ca20fafd0d539066f84d669f6f5e9401c223b82e200501716c719d268c3c1a0
SSDEEP 384:4YsEJquUMovngPMIzVK6ptI6AmtycsOlrAyA/AUkkzmhygwREQ0mFfGQdJjwvSJf:9V0tJjw5o
TLSH
T1F373D911AEE66258F4B6EA06BDB704580EF3FE805835E11E0059295E4A7BFC18E1DF73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1038\LocalizedData.xml
Size 86KB
SHA256 e4261c9b8c779d58883820a531a19594d238f0ca9ecac399505c569b0cccdbc7
MD5 28e8a2833f3d5302a1f5c2a84fa8990a
SHA1 08977251eb62c6df447c6754b2ec27a73d9071f1
SHA512 4a62afe84d4eb03bf2c65826b5765f270b3c9a3403b972bb00db66cb40b70d1809334fc3a8edf012c1ea31e4e3b8c6fed6423e9da14dd62ad76a12d525e515b9
SSDEEP 1536:QZa/alahI0IwCIu4F70S9BIzEERIJH0rji3kC4ILiv:QZayIexCXF70S9BIzEERIJH0rji3kCle
TLSH
T1C8937011AAFE2218F0BBAF157EB711940EB7BE905C39C11D0099294E4A77FC58D25FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1040\LocalizedData.xml
Size 85KB
SHA256 2ec36fb871853f60085bc972e08156483384f8c1d6e000f5db1cc8cccad05f8c
MD5 e74a35a00e0228de37ee911f93411ed2
SHA1 c1c0901eb552c21ce2817b7edb94af611b571a49
SHA512 8876e39093448d1ae5a1f53499272323747789fbaefdf9bd852fee161fa9c18ce0721164473a5a2279643b34a2727d870e0b802635288f2e32b15c40660ad06f
SSDEEP 384:4YmLGeyl/eSWPD66KUtycs9/wTBiG+Hg3XLCMa1eHzNZNs4fuD4RBJBo5U6sxuwv:C1aYtJGk
TLSH
T135836E11AFFA2218F1FBAB04BEB711944EB7BE919C35C11D0099188E4A77F858D25F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1041\LocalizedData.xml
Size 75KB
SHA256 ae28910c1ef16ce70a5e97c5d02390ad8d64f80966e2be3c4a56db0c4038442d
MD5 32e4d6f895a69bb2c373ff4c688d6b27
SHA1 57738235363c5f1a1c5651c65832396e3aef4414
SHA512 5052e8a218cf71b0e08de33665a58f9219282e00f2e4f6c19897a07863556a2408dc273ad3cc9257d98d6a57765321e0f1b051bed051f188947deda9d32dbdbe
SSDEEP 384:4YZUFNhaVwV/VLVWPD66KUtycONAk8mZX4++oMeRCcLsRDJDhFfv:edGJ/
TLSH
T16573D711AEFB2218F0BAAA55BDB710940EF7BD905835C12D0099294F8A77FC58E15FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1042\LocalizedData.xml
Size 73KB
SHA256 e86656ef2092c0e6caf5b8b0bca2d6ce5def273609c22187ae91236605d2e273
MD5 47f8082069c52d2f7db1fc6aac2886df
SHA1 4b5c371e9006c10685f2c59ca9a7ebfb4a597a0a
SHA512 7bdaf721e561c46609054f6786624149fd824abb1e3126b2a6b6385b56c6fe11414af216fca3ee2b1fe6a4b42ca8a19f46186ab1d4e70fb81b6f9af013c40018
SSDEEP 384:4YFyFFhyV4VnVLV//rCjKUtycONAkbETFU9WiucznfYbzqRjXU2ggRZVDhYAS+KY:1biucUb+xJr
TLSH
T10173A712AEFB2218F0BAAA55BEB711940EF37DD05836C11D0099294E8E77FC58D15FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1043\LocalizedData.xml
Size 85KB
SHA256 8afdf3d2c0fd2370889e3fd96bc2742831cdc6041af0a407123c27f8d76d68a6
MD5 e939717e7eaf1b7f53c4b752e62a22e7
SHA1 ca5a66c452ec6ca8bc04de95eac1616cf3980992
SHA512 ebfa725b8efc4448d669beea6f56eab9a317793ff1e21cbc51e015a1a31dfb8b1408e9df15023b878aca220465dbede09254f9a524ef7f6060877844994e17aa
SSDEEP 384:4YroNVxJ4i/5Qbkkk5vWPD66KUtycsyUja9FQvFzyDZAZIudv7YGoDq1RYktgNVX:GvREQIudjuqGhHtP0tJJ8Z
TLSH
T155837012AFFA2218F1FBAB157EB610904EB3BDD15835C11D0099298E8E77FC58D25B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1044\LocalizedData.xml
Size 84KB
SHA256 3c309a5509d42e6485e9123bc6af5ec43cf2faa8afead5062676e85ab7f96add
MD5 b0d9e4dac3935bb596bb83b7d8474f8f
SHA1 29ce971b1a3ccf6f09eced6bff8e778df13f3d35
SHA512 af4e4032a3b4a1696a3f252c03c8f5364089320e4181ebccd39d569d7577b11b70b4ae694d4a74e09bb61505664a01733dccb2d80aed64cb7142225dddd997e2
SSDEEP 384:4YX7lskoDBkIWPD66KUtycONAkhdkmgJljMFwrbDbGBklKn9COrtQ2GCJYkTQQv:UkBU9Ct2GCJYu9
TLSH
T1FE836D11AFFA2218F0BBAB15BDB600940EB7BDD19C35C11D0099298E8A77FC58965F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1045\LocalizedData.xml
Size 87KB
SHA256 2f0beba8a56cccaddfe6e0ecc3130d0efafb7f84cc0fa4e8db9d85c840e24241
MD5 c3a238ffbf2dbb9f758e5c5b33948971
SHA1 56ceb241f3780dc4a9814332f44369188ded3e77
SHA512 2def165951b958195a339f8b4a38aba310c428fbf89f0d7e708d44255f3cf59953550f8e4772626aa125e4a2cb3328601b5ca097f5e355423f4d5094cb8155ea
SSDEEP 768:9QUuGp9Vi0iG0XE2Uq4DplOe6lsQjPLJbOzdH:/CjJyZ
TLSH
T18E93B011AEFA2218F1FBAB44BEB710944EF7BD91AC35C11D0059298E4A77FC48D25B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1046\LocalizedData.xml
Size 84KB
SHA256 aadbd1df74fc82a43f86f1f40d5065a802b2db71652525a78d258fda3197a743
MD5 4a892aa3fedbfe5991b6ff46c00af55c
SHA1 421fe8f80432c56d022ff2911c4a5708093184c3
SHA512 9391096ad6c721b50a300f3c8285291086c0f302f77a7edee7283ec8eb7432171edde5998d5c76587c6431eb3c7e5cba176d0c31f6963acd8d954ea9c6a6e619
SSDEEP 384:4Yjbb8UAjJUgYN5s6KUtycONAkIuroXIGSPchHL4lzSv3kOY8vg2m/qKdxEcyJ2w:qUbcyJzyN7K
TLSH
T1F2838F12AFFA2218F5BBAB05BEB610944EB3BE919C35C11D0059194E8E77FC48D25F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1049\LocalizedData.xml
Size 86KB
SHA256 a787b2f493c3248991877f61e210bb0231d357d06aa2671917d2ad4e528c9f67
MD5 d46f34e95e94fbfa4cb4a8dcc7ba3211
SHA1 3e2150c9dd44c4b3416051534ccf84968f2737cd
SHA512 c740f7eba5187699b39265ba2238121a20d935d1320c0e344b767d537618cc2954bb7a6bacae12e7121cd1b4bca1ceb84e11bb80a347e7c2c79e87eb899adb7a
SSDEEP 384:4kbCNVxJ4i/5Qbkkk5vWPD66KUtycONAkDS72HrkSVfGo/RGKVcng5/spnBthXlK:EfVUJi
TLSH
T17083E907EEFB2214B0BAA6546EB704D00DF3BE905935C15D009F2C4E4A77FA55A25FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalizedData.xml

Path C:\89710c8eee7e15bbaa2b\1053\LocalizedData.xml
Size 83KB
SHA256 874e5d7e45603ad70ca353e8dc6bf42944594f911d17c79be8966dc01d27eb73
MD5 cb2e2edf7d7fefde9b3894923407f8c0
SHA1 541ec570f26bb30f4be35f1a87d4ccf6bc660f67
SHA512 045fadda432280ec961da53b914adc9d9a31d02140282b3b37e89f01723d64b5659e3c1a61e9344f4440813efb8b932cf45f859b97cfbdc158c0802d70c5ecda
SSDEEP 384:4Y/w+WCXVVV6VOVWPD66KUtycONAkK2JuWf59pW7fx1uOuos98LSGcgqBV6kMQjc:yvV7fxAnIXrJJpoc
TLSH
T1DD835D12AFFA2218F5BBAB14BDB700940EB7BDD15C35C11D0099298E8A77FC58925B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DHTMLHeader.html

Path C:\89710c8eee7e15bbaa2b\DHTMLHeader.html
Size 15KB
SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
MD5 cd131d41791a543cc6f6ed1ea5bd257c
SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
TLSH
T1B672765326E84248A1B6BE49AFB640750B79BD45A83CCE7D05A0591F49E3F04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ParameterInfo.xml

Path C:\89710c8eee7e15bbaa2b\ParameterInfo.xml
Size 2.7MB
SHA256 a2bec4e2afd573422045c8c2f461166508535e67abd32942d4d6fbed77b9faf8
MD5 8e8c25b11ffe1d7bc70e2a31600eda7a
SHA1 1452b55ef634e4e5b002ce302702d0c50487ff6c
SHA512 4a622a5d3748ce412bf529b11d305a5a06dd381a9b972fa08d0528dc738d50a979307ce6dfb14c9b481952672ca9c3a1be43669796e5e178b23436b84bd0542a
SSDEEP 3072:4cveZOvedveoOveMve8OveeveHOvecygL+MscIl:mygL+MsJ
TLSH
T15ED5E11223FA0305F3B76D257AF588AA89773892DC34C35D406C158FA7A3E85CA62F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.exe

Path C:\89710c8eee7e15bbaa2b\Setup.exe
Size 119KB
SHA256 60dd7d10b3f88f1b17e39464bb2d7ca77c9267b846d90cf5728a518a117bd21b
MD5 057ce4fb9c8e829af369afbc5c4dfd41
SHA1 094f9d5f107939250f03253cf6bb3a93ae5b2a10
SHA512 cae4df73a5b28863c14a5207fbbe4e0630e71215aa1271fe61117523cc32b8b82cd1ba63f698907fbfeb36d4007bb0f463828025957505cfcbb200f4ed5d3a52
SSDEEP 1536:jC5s1sWfcdmUtZ4e8ZXUSbeQCtyXWPQqOkAzoIt01WZnqxMQP8ZOs0JzoK9CeAUY:jKLmAgUSSQC4XeDOkeoNQ/gBFoWCnU
TLSH
T187C36B43B5D0C4B1D476193148B2CAB15E3F7E224F604EAB3394762E1E712D1AE36E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupEngine.dll

Path C:\89710c8eee7e15bbaa2b\SetupEngine.dll
Size 893KB
SHA256 236bf2b5cf6014b8ee22484afe172ace512cc99dba85080b082d47e9e189ea5c
MD5 f9618535477ddfef9fe8b531a44be1a3
SHA1 c137a4c7994032a6410ef0a7e6f0f3c5acb68e03
SHA512 b85ae1a9cc334e9352c51aa94b2c74c6c067957e0e6021f7309a1c194fc64c0c50bb5efeaef7030e8689d75a22798f74cf719366a2fdcce26e23692510bfe064
SSDEEP 24576:ZG2ynlYANtzSXWnTNPO5I4IHm7ONx3ZFaJ/KGvUnh:ZG2ynlYADzc3I4IHm7OjyJ/nvUnh
TLSH
T14C1519213EECC035E7BF077079785616697EB8704B70C98F62909EAD2A31BD15B34B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UiInfo.xml

Path C:\89710c8eee7e15bbaa2b\UiInfo.xml
Size 63KB
SHA256 b879f9bc5b79349fa7b0bdbe63167be399c5278454c96773885bd70fbfe7c81d
MD5 c99059acb88a8b651d7ab25e4047a52d
SHA1 45114125699fa472d54bc4c45c881667c117e5d4
SHA512 b23a7051f94d72d5a1a0914107e5c2be46c0ddee7ca510167065b55e2d1cb25f81927467370700b1cc7449348d152e9562566de501f3ea5673a2072248572e3b
SSDEEP 1536:24UR0d5vud5vcZ2QYQLIN/N7pfMGgrX8FPirziPfwws36z7y/HoQilwJwowJwXZR:24UR0d5vud5vcZ2QYQLIN/N7pfMGgrX5
TLSH
T1EF5319535FEB0118E1F6AA4D69B304701F5B7A45083AD53C14EC364EEFE7E6288A07A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqmapi.dll

Path C:\89710c8eee7e15bbaa2b\sqmapi.dll
Size 223KB
SHA256 048d51885874d62952e150d69489bcfb643a5131ce8b70a49f10dfb34832702c
MD5 0c0e41efeec8e4e78b43d7812857269a
SHA1 846033946013f959e29cd27ff3f0eaa17cb9e33f
SHA512 e11da01852a92833c1632e121a2f2b6588b58f4f2166339a28dd02dad6af231a2260a7e5fc92e415d05aa65b71e8bbda065e82a2db49bb94b6cf2fe82b646c28
SSDEEP 3072:dl5e8m9Z5G6ZUMIiaQVedGGEc6SYm8X/UvHFupHIjNNlMi/fbtcICcu0b9+x0o/N:WG6ZUon6GVSYmnGHEvlMMac59+xfbZ
TLSH
T1372419D1E1F68071D3D2133072592377E9FAA92F2DD8BE8B1380E7573830982D66975A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MOTUCoreUAC.sys

Path C:\PROGRA~2\MOTU\CoreUAC\x64\DRIVER~1\MOTUCoreUAC.sys
Size 386KB
SHA256 92212b911cf4b8611f6220c5c02e3b0fd7c2d81a4b9a42831e9b620bdc44f26c
MD5 5db4e22f3cd494a929b05347110ba404
SHA1 6211f13bc834534b3b419cdb28bb83760d0e8bf8
SHA512 329f34ce419c6c4e55f35154c6b2a4e870909a6a012201a02df969088bb82c56983cd1efbe1fe2d2937da95f5bcf0e2c491786732a1e3f5f6a8f6b5c673034f4
SSDEEP 6144:j0qLpLwYkGmBfQj+HjTX3/mHCbOlcSBti8w/8EbydliuuD23zr5So1dN6IAuqRq7:P4GCoSjT/mHCbOlcci8w/8Dicn7KotXN
TLSH
T1B1849EABE3B504E8D1ABD179C662C407E6B2744513A0C7DB42A0874A2F777E0F97E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

motucoreuac.cat

Path C:\PROGRA~2\MOTU\CoreUAC\x64\DRIVER~1\motucoreuac.cat
Size 12KB
SHA256 14867208ffa6c6b3d3ed874bff0217c4cb5ad6c354552061b9c0c66258a76f31
MD5 4da65706b9b8378b36f8d8ff005686d6
SHA1 5c8d03ef54f4dbcba51ea1e2810a9938ed198bf6
SHA512 352c5eff1e29c1c434b55e349a762a5733e385cd9ed91b66de585f2136a4fde560a902e7d11537b1b9d5c2b501417a700d89f5690246a69b92f7ef893a6cf338
SSDEEP 192:wKE20JCiLINjRfT+/OXJEwlLdthYCL3mVueTXflYBQXBnX01k9z3AWWqh9O6:MWT+/ORdth3CcUthXBnR9zRWQ9Z
TLSH
T1644208A246694082FE97AC7093E8F9473C3E37CB6C10447926EAF3594D573C8EB2516E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MOTUMSeries.exe

Path C:\Program Files (x86)\MOTU\CoreUAC\MOTUMSeries.exe
Size 2.6MB
SHA256 4acb97abdcaacf7f6d476bdbb5ecdc128c72ca99f63ecfdadd6af7210d8703b7
MD5 b052c0bfa7492dc7f7b73b239f5e020d
SHA1 76ceba339e8d0515bc5ffadd27c18a54b354bdcd
SHA512 ccdf588c3cc5e281d3c35b9025320def5fbb047a0709285277f862f9187a5de47da539c434a7c64be8289ad0ef5b714ae7dcdfcd8324d3610bc4f797eefb8913
SSDEEP 49152:/+5UkcaL/zAmPG2Y02NykcF+D13NAStTzWfHd0royusivUEpabdPxW9JUkimFsHJ:G5UkcaL/zA7tTw0roLUhxW9JUki7
TLSH
T18ED5FE701911F903B676A83AAC73A52B96B11E1287E5A0D6331E38CDC7ED774B5CDA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSeriesLib.dll

Path C:\Program Files (x86)\MOTU\CoreUAC\MSeriesLib.dll
Size 1.5MB
SHA256 17b416e449b59237673b749cb435c15ed33c669451c64066e7e0b65813cb997b
MD5 cc6edea8e002a78446cf5d04aa0067aa
SHA1 367d09bcda29061c80fb423c39b6b9b8d4691ab4
SHA512 fbabe5340529dd8e8e20ea00bcaa59240b99d95bd424082390a84d24b8724d1d1eeba53d6684b91ca9187e13abea9e0f773ec6b10a1e82bc0db5f5fd1a3a191e
SSDEEP 24576:KrDJiipT/dd4dtjdvo5cGBz9Njd7gpI1YEDgizNPcO9Ed8usVjvqFgdiRzn:kiidxdPDgiho+GSdiZn
TLSH
T140755B40A6EF6E7BC3490870315EB53B56342721928C89F776D18D88DEAC7C17EEB066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ndp48-web.exe

Path C:\Program Files (x86)\MOTU\CoreUAC\Redistributables\ndp48-web.exe
Size 1.4MB
SHA256 0bba3094588c4bfec301939985222a20b340bf03431563dec8b2b4478b06fffa
MD5 34a5c76979563918b953e66e0d39c7ef
SHA1 4181398aa1fd5190155ac3a388434e5f7ea0b667
SHA512 642721c60d52051c7f3434d8710fe3406a7cfe10b2b39e90ea847719ed1697d7c614f2df44ad50412b1df8c98dd78fdc57ca1d047d28c81ac158092e5fb18040
SSDEEP 24576:xGHL3siy910NSmtLvUDSRbm4Jah1rVx8MjoGO8W6cbZtgd6AmpITsz0+lLF7cy:mL3s7K8eTUDBzrVx8MjoGO8W6cbs8NpT
TLSH
T12165222333B0C473D0A3163097A1A3B62D79B2BB4370854BBFA4572D1F667D066B9B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MOTUCoreUAC.inf

Path C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages\MOTUCoreUAC.inf
Size 62KB
SHA256 dd7199ae4edee77de467526c4377caa9ddd1745abf677d0b9ea2de0dd44df4bc
MD5 44e6cf6b4cfdb6ebb08fecf2d451eafb
SHA1 aa795cb1e3636a2b09ee9e906b5e1651de931aac
SHA512 ddf5c91d04cf6fbc85506be050a8cdd1c1d4b03aa3da43890c73d700a1b64de947e69a7bcdd3601dc2b9ded015f828e9f4d4fb3e1f58088bba60591ac0854fe4
SSDEEP 1536:dtMUskEc0cMOQmMOoWkp86cmc6c+c8U0cEM8E50igy0q4KkwcEIw05AgAQQgQAQx:dtMUskEc0cMOQmMOoWkp86cmc6c+c8U3
TLSH
T19F53FED953AA7C5D731301A4D25328E30CDA5CB980D50218A616BEED6DCEDDCF324BBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MOTUMSeriesUpdate.inf

Path C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages\MOTUMSeriesUpdate.inf
Size 1KB
SHA256 ffecab589662a874dfa2f77a82ee16a74ca2106241ee3f7ea8f755a6c53e312c
MD5 07f42aa9e125735ba6d2d918ee8c8ec7
SHA1 bf7442de08118bc48fa4908adc9860814605f7ff
SHA512 77688ce1cba7da4b2d39f7923998227bb4daee0d24571673cdadf09b9b838fcaccf8839428c9cfd7cd0ba4748eb996e20b39811f8bfbaa6d13f2301b8b07de79
TLSH
T199312091A95F567156032B5CBBC31C41B69026C0C2AE1158F7EE115DABC4B8CB30A17F
MD5 SHA1 SHA512 TLSH

Submit Download

MSeriesDriverUtil.exe

Path C:\Program Files (x86)\MOTU\CoreUAC\x64\DriverPackages\MSeriesDriverUtil.exe
Size 339KB
SHA256 1bacdbc4bfc5eae3ffee5b9a46b6b271fa82edceb8dd7cd43763c8a2abc4f467
MD5 ff21842f4c4751b3e19ae1733b2d2b74
SHA1 4234ae01efb1eb8517d84c8d8c60a380a776c7ab
SHA512 9827a8866f6ee95ac6f4d275490ea5ffbe0c07d92e5c923bbc432ebc0311a86edf276ecb18fe22fcd452ac6ee61e8d444916c6ac15ceaa11c1f5d943cc0c5446
SSDEEP 6144:rLmRagBoG97pWpeYxPBuA+mTi6jDR3ZTd:rsSGfeeYDuWi2VZB
TLSH
T1D9749D1AF6A514F9E5A7C13CC9424906EB72BC0647B1E7DF23A04A962F237E05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36d5da05-7b7b-42f0-9c70-aaf6a0a65f57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\36d5da05-7b7b-42f0-9c70-aaf6a0a65f57.tmp
Size 33KB
SHA256 70095dc24b717b2d94e4ada700a7aaccf39cb0d1191a863dc97d35f3435b32ad
MD5 3b140ac828daf3e336eb2ee995eca8bd
SHA1 c0d02c1082bfdadaea0a9cc4d1a32c2de0ff3464
SHA512 4991b398c0ff8f343b24fa70c5e6632d30fab3834aef9b1644c103cedc026ec3308ddc24ef57a9fcc5d8a684e029bbe9c659b441e040c438098ed66abb0a32b8
SSDEEP 768:nX3XhXK3OyZMo1h3Yogkl5akl8pbHW0AWDHxT65Lp:nX3KD1h3Yog05akl4bHW0AKs5N
TLSH
T1EEF2AF35A875EE774EE6A245721D3253BFE4D5239AD40A8485CDAF1D028B3AE034BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a149408-560e-4f6f-b2f8-0339e186e2d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3a149408-560e-4f6f-b2f8-0339e186e2d3.tmp
Size 38KB
SHA256 d432c839566b435173db9cbba19284ec600b233c2b75f89084896e3d1601e622
MD5 cd7244f06e04e781095857ef574dcdf5
SHA1 346fd6238c3f8d9c9e9e790cde1afa025ba3f813
SHA512 a6f5e70f9df7d900206b39b1f4d772fd447e07aa838d2c59f087f8fa7f30c17b1647b1d4da6685e06bf2895e2180d6ab46ea03df712f4d158cd8b1117b6f9473
SSDEEP 768:4/UxvxjgC+CZ3n1K3OyZM41h3Yogkl5akl8pbHW0AWiHSHvP0Vv:FZj3+I3yn1h3Yog05akl4bHW0AdSCv
TLSH
T1C103C035EC75AE735EE6A244721EA217FEF895639AC45A9444DCAF0D028B3BD030B853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69af0e9b-3c62-40cb-8de5-418a4bea1239.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69af0e9b-3c62-40cb-8de5-418a4bea1239.tmp
Size 37KB
SHA256 664a1fb84da973ae6d90080e7662b4aa20a8dfd82773edb73e4dee7f587794fc
MD5 b475ea01466ca4663514c92d0476effe
SHA1 157933de7ac364df8ee160580266f234ff1004dc
SHA512 1753749aa98b77b120726da6b199fd4c0823b130c5e2482326b4298f280b23519f51163d898642abaf2dba9e9da99816330371fa1f16b1471926f0ffad232699
SSDEEP 768:B/UxvxjgC+CZ35vK3OyZ31h3Yogkl5akl8pbHW0AWTDsSHvP0Vv:UZj3+I3q31h3Yog05akl4bHW0AGsSCv
TLSH
T15F03C03AEC65AE778DE6A244760EA317FFF895636AC1569444DC9F0D02873BD030B853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69d423ff-524f-4251-bdfc-ac6f2f1b9cba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\69d423ff-524f-4251-bdfc-ac6f2f1b9cba.tmp
Size 34KB
SHA256 6106959f5484b2ecc757907e889e1820fa1a9273a4a31c10fe1fc31793761762
MD5 3f252414f0ddcf51d17c5db27baa2009
SHA1 624989926c2dc48c41c7f9a37b4d912b6ea1c73a
SHA512 67766c2ca00612b399e3f5889b9a265a43c09d18fee7c773a1c49259e994f9ab5bc49fbdf05d6dbd72b23ce3de9430b228eba53a7ad125315d769985d753df7d
SSDEEP 768:gX3EhXK3OyZMo1h3Yogkl5akl8pbHW0AWDHxT65Lp:gX3hD1h3Yog05akl4bHW0AKs5N
TLSH
T1FBF2AF35B875EE774ED6A245721D3253BFE4D5239AD80A8485CDAF1D028B3AE034BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83a30ebf-dc22-4192-ab03-4e8f4ac9be5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\83a30ebf-dc22-4192-ab03-4e8f4ac9be5c.tmp
Size 41KB
SHA256 5f4b59d7f749017148b3d38c6f173304995c81129eca4ed3427c44b439f2065b
MD5 02e329909e3fc76b74520dfcbec60bdd
SHA1 5aad2786c7d84cf8435947cdb7eb8ad519cec7ef
SHA512 ecb073802dee1bc9e02d22a4856693a1697e89f0091f86b13930dac1d2a63f1cf16240fb436fb418029a0419c035ab89230d8c978575f93c5411c17e28eba021
SSDEEP 768:SF7r3owgeyXK3OyZME1h3Yogkl5akl8pbHW0AWDHxT65Lp:ur3Z31h3Yog05akl4bHW0AKs5N
TLSH
T11D1349F298E79A77CA9E9747633D2E12AEBCC113B9D44544B7C8590DCD462BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

954f4e43-ab23-4e5d-a65d-cc9877b53417.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\954f4e43-ab23-4e5d-a65d-cc9877b53417.tmp
Size 41KB
SHA256 f07b222302c578e1a0fe686deda3163e893beefa107c3d29b780c4b29af2fe92
MD5 4281c77a172a30d5a93d18671b60e42a
SHA1 d2cea70487032107956d400b3fdd83599dbe87ed
SHA512 636b36792387c94c4d0f5053af2594def74a8e5d6568d7ddf9df396aa36004c8f4f720d214740bb8f7c4592002b6517757c235a62f75882645b00b9c4a28d373
SSDEEP 768:SFd73lwgudXK3OyZMx1h3Yogkl5akl8pbHW0AWDHxT65Lp:i73jO1h3Yog05akl4bHW0AKs5N
TLSH
T19A134AF298E79A77CA9E5747633D2E02AEBCD113B9D44544B7C8590DCD462BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e1837ee53009f9b691f7aee3be45ffb945d4894bf04ccaf875b9947114bb5224
MD5 58ba31abb4a3fd3bbc9aadea4fc9ca13
SHA1 d79c4b2ccee6dadb45162ea34fb988911510f0b8
SHA512 0c096d7f5d364e0911d26f4bc2ea03e3d81b2026be5182b04fc17e7949640761db8056138b55b28aa9abe884d601d2cf6b1be9e992fd3565c35c69def459d32a
TLSH
T1F3D02B3579ACD772C18C503A405901112A95F001FD46C1801953B10848913400006295
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0a1e646beadfff70af6a1dc73b6baa41188262ddbb2b7781270d4e94c92c02be
MD5 893220bb58a1416480d52375128fa19a
SHA1 3a577208211e9133f3744d9ba695501b0481ca9b
SHA512 b3f0e3d85398f7aa7fcea74cd44fd2709c0265d9072771dccfe7508832bc1173f452a0f49028e8bd62ea434676abcdf4a111c8e31f121871fbdfa4acf207b131
TLSH
T1C2D02B3179BCD772C18C503E405A01112A85F001FD46C1801A53F10848913400005281
MD5 SHA1 SHA512 TLSH

Submit Download

42b2bc34-ca6c-4c69-99a0-34ab0c5c9f8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\42b2bc34-ca6c-4c69-99a0-34ab0c5c9f8d.tmp
Size 11KB
SHA256 687560de77c16c5afda4dd1a285fe7b68455b7cf8e5ec30d30fe8e8353cb9262
MD5 20acc087c79b80ed60d6cd4e8c8364ff
SHA1 675c594bd74302b6e03f941ca0a003b9b67c3c96
SHA512 ae52766b268cdab26a1e35e1865d28ef4ad3854bed104a00eeb405cad76785afebd782231192205b014db422885a3d9eb3349f84284a1b6634627e4a8b4b4f7d
SSDEEP 192:sxRhR5b5/f4seqmByzoA8pQl/g6+WNqpe/Ydvl8G6NIgIJ:sxRhz5/f4seHB/o/55/9s
TLSH
T175329715AD78B93B8CCBD21DBA957F53D2F95032A1D51E48A6FC862C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e845c32-4161-4356-b3c5-2d8f9bf9b7fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e845c32-4161-4356-b3c5-2d8f9bf9b7fb.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 3d12fa88e2721d7c2b1021ebbcd6e4e07e6101421511c36111251b65aa4fdf37
MD5 dc174ba78c990b14eac630d53bab0bde
SHA1 18c3c00113654122bf8c03c202ac189915956813
SHA512 986e7a56fc30968ebcc0e161b2dd9d93e0fb5a7dfc73102aa4999d1b06ea0a2c94708c540be1c99e796f5b33ec89371888a726271150649c44bc6d37172a8651
TLSH
T119E0268556CAC22FF308668B01FE934DCF90676E92C0E91E1B00C5C4F105244A6E2694
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 c6d90ce064cf93daf9451140573896e0fbe5558e7b7c72e58e68691bedc87014
MD5 5c006a0890c94c3c96760f3b925bb78c
SHA1 b66972d79c86995830b1933287cdec1aa6b73aa3
SHA512 b61245ee536312c1f0a844a2be1f60bb2dde1b144d85688c2862cd58ead693daf5897ca8c1a2a0fde1b5276224fdfa720ad7439baea9244a206a49fd25739702
SSDEEP 96:D3jdLo6WGaxbcIJ48SEucYOfsKmXqTr5xEGw8pE1U3H9HU9PCf2RIDBTZdGC:dAgIJR06s1qTr3EspB69PCBDdfH
TLSH
T16FA1EBCB41BAE515F7743534E4DA08ACBB3B456E6EE38F11123BB0B05D66747A230978
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e422f7dfa9d4586e900b1efd0119e4dad978012900200302810cf38c94b4e574
MD5 44c961306684c1f061426fc74c7fbe24
SHA1 0aa3e2f91072e112f433c915bc6571097ffc66f2
SHA512 10971a887aa2579351f284b3a97f2706376905243e3dce2d690f594a63240bcf5dc41d5c00d9fb05232adf6cba509d5eed56c375f6eef7a8f55855ad8960ad33
TLSH
T1597198CB427AE519F3453638E5EA498D7F3394AC9EE39F10627BA0B44E6A341A070178
MD5 SHA1 SHA512 TLSH

Submit Download

af334446-2f28-4b8d-bdda-a5f8c18dd37e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\af334446-2f28-4b8d-bdda-a5f8c18dd37e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2710c0aa-9cc3-4c71-ae40-699758c1ff19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2710c0aa-9cc3-4c71-ae40-699758c1ff19.tmp
Size 4KB
SHA256 08ccb3a31b0a3ff53ef298486c05419ce57c2bc94d703221b259eb295c8ffbcd
MD5 a2030795f428b2b23f9259f73012ea0b
SHA1 deb976e481817cfa9d8d0d887191030be7a98354
SHA512 8dd7e6344b46a77c8de9f7bf3bcc3336ca2474af3e5a5616a5249b79462d599372b6ff8216809f664247bee630b7f48206c3dc34e6b686c5c4a851d6810199e8
SSDEEP 96:DrOTE+NvecVaaijhnpVzBMcPaWa/mxyHSwYGWy:DSTNNvecVaaijhnpV1McPaWa/48SRGWy
TLSH
T1F8A19DF787E482AED91166F4AA143F1BCE6D0515432C3C5AC5E4EF1BA3E2471E182B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2bc2e2ab-c2ee-4f30-b8f6-de3542484d3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2bc2e2ab-c2ee-4f30-b8f6-de3542484d3d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

855573cd-772e-447f-b70e-408db0e19572.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\855573cd-772e-447f-b70e-408db0e19572.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a3bd3ca9-319e-4701-95e5-1d8d3a75bf3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a3bd3ca9-319e-4701-95e5-1d8d3a75bf3a.tmp
Size 4KB
SHA256 0d69b6c7a54703166e94f169baf1536a81c05e631b15df76bcdd6e375a9578c1
MD5 9f0b5a8e5e2ef2ef6a483c5ed589fab5
SHA1 4e77ccda3334d5b9c9bdbacb3d817a987748d7bd
SHA512 f718b7e9cb59232b7e655a20c433e3cb61aa8e513058514709dc05a8f938e4e3f0e0018244dad5afc2dcd9a6a76816d42f8832672e07d0dc77baa9a98bf2cb87
SSDEEP 96:DrOTE+Nv2VaaijhnpVzBMv8PaWa/mxwBW/yQ:DSTNNv2VaaijhnpV1Mv8PaWa/4kW/1
TLSH
T11591ADF787E486AED91166F4AA143F1BCE2D0515432C3C5AC5E4AF2B93E2471E182B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cb2389aac138e8c75587fdf30fed16794e0e6d5e1a4391836f551452cdcb8db1
MD5 c02cb0bc924815a90109e6451beea35c
SHA1 d257238e181bdc8a16567cb278d0a71d086c51de
SHA512 0816f4c362051db0579871b0249c5b1cec7e28d72c27e0db88be9d7a13f1e232f72c632800f1bf0529c650ced9d5b2edf031e5afa22eaa23d1b6726bafaead5d
SSDEEP 24:Kqo8T8VWgFFqGWZ76JJ0IwyZK9GhF4Z1HgJSBb/ePWqyXbk8ITBF+qxBi7paJRIc:KY5I1KSwgXypoI3K5Gs1XIBKgA0XyN
TLSH
T165915405317647413C7E2A4850AB9F1FD25171733128F92F3BAA85A69E2BE041DFD9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

abd60e60-8fa0-4f7d-989b-96f5c6637428.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\abd60e60-8fa0-4f7d-989b-96f5c6637428.tmp
Size 11KB
SHA256 2d7045e630c777bfa799b1406b2c61a4bbe6f61d88a8cfacb445f085c915217a
MD5 7ee43aea827b5ad7dada472c5b72e110
SHA1 12a194c31878231f24959203f70a9c1da5c5f781
SHA512 70e4f661c08de62b7c08aa57abb47bb8c224767e8da056376d10a1d1b2f1ad34b0cd93b16a55c9fb04d61d5ad7b1af4582da24d181ebc2ddaf858155857bfd80
SSDEEP 192:sxRaR5b5/f4snqmBzzoA8pQH/g6+WNqN6ZYd0/8G6NIgDjRJ:sxRaz5/f4snHBie/5ZZs7
TLSH
T19542A615A938B93B8CCBE21DBB957F53E3F95032A1D51E08A6FC861C05EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b07e68f7-51af-412a-8f9c-949d2c8e7097.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b07e68f7-51af-412a-8f9c-949d2c8e7097.tmp
Size 23KB
SHA256 165d40dde95d487f0bfdd69e43ca79b1b8e973f2410d0ae1787c8ea8d1a6cb98
MD5 1861be94014f23bf9af8f05618e16035
SHA1 a9bd54bf1c4d64b43b418a28c88e138cc3f74cd8
SHA512 215f802a9ac50b3076efab96e9989a37f5fca1fa639f6a1fdb0bb9e8f6c1ca16d5b814dca99638bc52a101df501494839b65ce15040f195adc71546e48cf36f9
SSDEEP 384:qYe+z1ifCtgUGFf8SKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV269GGRLVroKrw:qF+z1oWgU6f8S8F1+UoAYDCx9Tuqh0Vn
TLSH
T13BB2EA2B604DCB7E4FC01A9D9C196F9B6D9802C796588D4047FED94C03C77EAA21A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d60193d9-f44f-4828-8652-745e3ea4ef91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d60193d9-f44f-4828-8652-745e3ea4ef91.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

fdc7b435-d683-4cc0-9d12-431669f1e9de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fdc7b435-d683-4cc0-9d12-431669f1e9de.tmp
Size 12KB
SHA256 f854ca457c727f99d68df08a3b27919d99313a538afcef8c61e80e3b0e4fbbd4
MD5 865cb3732f5ec744e36e3f8660e300a7
SHA1 819680d1cf57a18bbcf736ba0b931e1692a03915
SHA512 fdad6eb09c918768f8011f02fac2a7511fce65317794b610b0dc7fe5c0db05426284fa9e359ca0f42d8f4c06dbc434e25c210dd810bd76bad86894eaa4b6a153
SSDEEP 192:sxRaR5O5/f4snqmBzzoA8pWH/g6+WNqQmFYdZ/8G6NIgDjRJ:sxRaW5/f4snHBio/5kFr7
TLSH
T1F542A715AD78BA3B8CCBE21DBB957F53E2F95032A1D11E48A6FC861C05E76DD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

feedc2ec-d3b6-47f7-b532-6ee3f8695937.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\feedc2ec-d3b6-47f7-b532-6ee3f8695937.tmp
Size 11KB
SHA256 caaadbbfebebf6a0e65fbae152755d48aa7bfab4d56ee2c12c2b573181bd44e8
MD5 97b349dbd522cde8c170c35a5a729b34
SHA1 7092153bf6e0bf308293e85e43df2c9f282d51b8
SHA512 9db5831a5082ba0473581b10488765a27f22878bba38bc3b08e1aece6a4094f45d2dd7e120991541283423d5fe37cda18faea8d54406094313b59ea0bbfcb902
SSDEEP 192:sxRaR5b5/f4s4qmBzzoA8pQH/g6+WNqpe/Ydvl8G6NIgDjvJ:sxRaz5/f4s4HBie/55/9R
TLSH
T1F742A615AD38B93B8CCBD21DBB95BF53D2F95032A1D11E48A6FC862C05EB6DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

160a3c7f-5d29-4724-be0c-3ecce5e1919b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\160a3c7f-5d29-4724-be0c-3ecce5e1919b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 dbd7ad335d335d7fa9bb9cb5883dbd897f22404fed9859cfafa6f89195528068
MD5 08006cdc7dc8f83f0bf31237f9f6fc73
SHA1 036efb2495745797e66d495c9a2d01ab18410ff8
SHA512 5f7e6047b64582920ac66bbd2410a3022d8c50d10cee1ecc976d0f601b37241577b4a135036ed4dfac623183efb4b8fe85e9e600df37b98e5778ea2b50fb3a57
MD5 SHA1 SHA512

Submit Download

bdab5de0-43e6-4c54-ab77-5c74969019d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bdab5de0-43e6-4c54-ab77-5c74969019d5.tmp
Size 392B
SHA256 6c36166ba55ee00ec6c84457c65573fe5519825568296b5374a03ba39c8012a0
MD5 332ed27dbda8836de1c37b537317d475
SHA1 2ad0a76a31d65104b32fd400be6ee92e1e698abf
SHA512 2d7fe7f0722f3737aff078f399e8c5d14e20d99fdb073d3db51d330f2b28091c8452608ff8b2f9ca45d5787a4fd2dbc16e44602214ffa025b217587488360340
TLSH
T117E0025512200133C00D533110471F502FD1C60002E1634F0730429C1C323163934B01
MD5 SHA1 SHA512 TLSH

Submit Download

cabe731f-e372-4f0c-ade8-db1a6c6a3557.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cabe731f-e372-4f0c-ade8-db1a6c6a3557.tmp
Size 41KB
SHA256 c110d78c3fbcae0e603e43127bc8a9e450ab6c44358cc00fef519ed66090e7ba
MD5 c8775e3c9c2e52a1d01e39610a373796
SHA1 f857ebfb3d0c85aeb75aa8bf1851dd846d2263e6
SHA512 48e0e3b6fc05a85f2db7276f3569dafc5dea82d2c228352d2a1f4558e477f0b44957eff7e100b3bc4945fffecd30b5741083f1693a965c006b5a38c4353f69ff
SSDEEP 768:SF0F3lwgeKXK3OyZMC1h3Yogkl5akl8pbHW0AWDHxT65Lp:ZF3Y91h3Yog05akl4bHW0AKs5N
TLSH
T1E6134AF298E79A77CA9E9747633D2E02AEBCC113B9D44544B7C8590DCD462BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d135593a-11bb-4c7c-b47a-3b259342a7aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d135593a-11bb-4c7c-b47a-3b259342a7aa.tmp
Size 40KB
SHA256 48d944481a8b45d199ebeeaa8ee5d1e34eb53d1ff2eb0d55ddfc49a17eba4711
MD5 e1cc71a096fe5c1bc1ad691a879fab4b
SHA1 9c58e0b8e99b1f6a392e6f6a63e23841c9309653
SHA512 9565cbc7933efbd3f7452b88cf7a6bc20b13f331eb2313b596955d4d284da62c4b16b1b4d4daf28155d570501dbf5908a2e79f3d44e1d504a749e777464edf50
SSDEEP 768:q/UxvxjgC+j3XeXK3OyZMV1h3Yogkl5akl8pbHW0AWDHxT6vo:vZj3+j35o1h3Yog05akl4bHW0AKsvo
TLSH
T13A03BF35AC79EE735AE6A244721E6357FFF494236AC45A9844DD9F0E028B3AD030BD13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92e19bdb-28ab-476a-a5d4-d697b05e2c63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\92e19bdb-28ab-476a-a5d4-d697b05e2c63.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

HFI9AA7.tmp.html

Path C:\Users\Admin\AppData\Local\Temp\HFI9AA7.tmp.html
Size 17KB
SHA256 46754292061dd47dc8c39c28f68ce1f6390c6c1e10be2af20ba58b9ecd401f3c
MD5 c5b79a2b13ec04f4cf12012a1f494dec
SHA1 8bfb7fa00fb2f28960e8639bafaaf879dde38f7e
SHA512 981c75fe22c3bc532abf52902170a8a83580e34d0f5a5e301513d4fa9e32f5e91ec3186ddc8fae7009a1122993bf7aee4f4b77fc63874396c97a5f4d69d55a11
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjrh4:fdsOT01KcBUFJFEWUxFzvHHa
TLSH
T1F782695326E84244A1B6BF49AFB600750B79BD45AC3CCE7D12A0591E49E3E04F872FB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp

Path C:\Users\Admin\AppData\Local\Temp\is-RV3JH.tmp\MOTU M Series Universal Setup (4.6.0.705+cc30ed084).tmp
Size 3.0MB
SHA256 398eba8a701c6820e4d3618d6f957bffb6a74aef20908d698bebbd7bb4a12f7c
MD5 521a78eb3cbcdce6fa650109cab8bae3
SHA1 8e7ae2d0238efb4aa13b5efe68389fa6ad63fd9b
SHA512 ac217d83323ec19ed4b461f25b41cb4246f37f2f05b23e26924974eb268932936b60ff1f71789315ed01fdc12a1ba957364eb3a5aba06bbea56125996e1263cc
SSDEEP 49152:8WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbE33365:YtLutqgwh4NYxtJpkxhGP333U
TLSH
T192E53A27F28C713ED06B3A364A3386909837F66179168C2797FC794C8F365942A3E647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

motumseriesupdate.cat

Path C:\Users\Admin\AppData\Local\Temp\{8a062871-f659-d64c-83c0-f5dbf8824846}\motumseriesupdate.cat
Size 11KB
SHA256 02971fc3c6c7880412e6e4d247dca91df4bd7eab4d4f1c65299c43dc1dfe888a
MD5 8bfb2407650c8d2e653fc894677f2084
SHA1 0a34982c68b54e841e5b39c5d73c5fcd3d8b84ab
SHA512 c83450035fbe6c713acd300761d794e9337c938e11c38d4e0a37bc898ddeece13d31ca4019ca4486e2f3e7f1f113eaec309b47aec5887a915052938d58dbaea5
SSDEEP 192:w0jnJCiLINjRfT+/OXJEwlLdthYCeDIfgtUX01k9z3AF6YgTmh:waWT+/ORdth37tR9z+CTmh
TLSH
T1C43228E246684483FE9BEC7053E8E9473C3D27CB2C00546A17EAE7585D9B3C9E72416E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1e1900e-0308-4806-ac63-7d024494b940.tmp

Path C:\Users\Admin\Downloads\f1e1900e-0308-4806-ac63-7d024494b940.tmp
Size 5.0MB
SHA256 2815691f4248ac398bdab791f5b3d82d3050aa843167a7693bef527f13078ccc
MD5 e7cc2cf6302a505d833482848fd427af
SHA1 9c48293ccfb58555c3fd82f40aee7519ddbc6577
SHA512 b48be0830439d40f48614384e0f58afe62a21b25202f9d6d0cb1ad596b66bc1927aedecec4914f2b8ba4e0ca38c343c7161352c577826c993cf117ccd1c9066a
SSDEEP 98304:fkLUpd5Fw553pwN+HYd6c+FObt2Bn/JmdR6oDkW/GumZNY/njg1U9FhbZOKCCy:k2d5FQ5ZG+G6c+xBn/AdR6zuyivjg1aO
TLSH
T1D236123FB268653EC5AE4B3145B393609D7BBA61B51ACC1E47F4090CCF668701E3BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem0.PNF

Path C:\Windows\INF\oem0.PNF
Size 6KB
SHA256 66aeacb5324f2d6ca783260da24901f7f858532df195dce5dba4b69ec62f9a77
MD5 b0ab07030381cb6cc045cc5066a138f1
SHA1 f960851ede75b1381d5f7645e5840e69b46f7d81
SHA512 f16ca703841a9e82c168241a48b28b06bede482db56ed1d6495a6d87987fb08c542ccb8f7478d19c693296ad71dcf268e00141ca7ddd1de92f4067be3c4ffe28
SSDEEP 96:M4rgQY2e/NI0IXSu6o4zvM181fQ1UvZUuQSCUJ:c2e/BfosxZUK/
TLSH
T1EFD13645B7F88B15F1BA9B306DB512E65436BC619C12C65F3160334E0D72E949AB0B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem1.PNF

Path C:\Windows\INF\oem1.PNF
Size 126KB
SHA256 98f719beb197246576bf2de8db415fb7072621ab6df2784c2d4566f50d45db36
MD5 711558891bb9c310eba6753d1ff581dc
SHA1 3f29b6ba13ffa9ea80a42845585e2d07df8ecea0
SHA512 9c5ea62ae71f4baba78420a990711b702456edb8ee6f03c6845fc8bccac9aab0deb7e851d2e0b306598005e7bbab4fd81b030750084d6eec24a503a3ca4a29ed
SSDEEP 3072:1oTU+iTZ4v7m4seAMetDVHKVXbQtA68DVSIFYVY9sTNWOZPS7Moudb5uB8bojoN8:12eqyt+
TLSH
T172C38B42BAE40769F2B71BB58BF640CA9D76FDE15D04E78F1040764F2971B418EE0A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem2.PNF

Path C:\Windows\INF\oem2.PNF
Size 6KB
SHA256 b0e28bc9dc700a0261e890bc90c281e6efc9f0fa7cbd2fb328a908cea3026310
MD5 6f3a3df33aa6266a7f9ddfe02d2ded7e
SHA1 1c5bec858699e93b8b4b5bcf611e72f1660d6c79
SHA512 60e4dbf27688165c645d4ca17d9a22813fb2b0a320a3d1060f65aea5b710812d957f3543e76febacd2df4b53ca4554f9f4b6c194c30afb7b9a5358ac2387d3fe
SSDEEP 96:bHZvc5z6AsvXB/3puztc37oQ3fU8+R0uN:+z6AeBvAc3k4i9
TLSH
T19AD14646B7D98E19F2B78A74ADF460EA1462BCC35C11CB5F3254B30D6872A84EBB0725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 69KB
SHA256 6a49e87770f39b289c93712416a565ce46054684f224bfa39822c0b72bd8c4fe
MD5 98251455658e3f88245defdca41c3ae3
SHA1 3cebb1e9ed9f1b0cb385f92c8a8f31e1a9d09cf1
SHA512 15f6c9b47fde935ff55573ae86e84c85e8d3b908f44b9ffe33c6eb66c180eccfc8ace77002f2c8532e7bc5093cb8959219cc16983b17a7085a5f4fa2d4ce9449
SSDEEP 1536:RHLFsfJWuonfMi/JiTcdEM7ATnbAI+P80l8DgwzWGfZSvcMfqCJDJ0IcIZZjAS7t:1HtKy
TLSH
T140634C0580DCC649C9F61DB27259EE71D53E6A9A770F5EE930EC63009AC2F042FBA479
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

motucoreuac.inf_amd64_822d6a50f76f42aa.ini

Path C:\Windows\System32\DriverStore\FileRepository\motucoreuac.inf_amd64_822d6a50f76f42aa.ini
Size 434B
SHA256 2fe40fd92eb27e963a148466465b74b186ceb72cdcaa9535a8177305dd006ee4
MD5 5ea5cb4f047150aa5e0a6051566457ca
SHA1 f2877f80604835ee8ee88f56c60826a274a6bab6
SHA512 96f539b9ead781d1f0bb60295f0941c7081e96e6330aa2f928008ae2a262d5855f9e73a5afdb35e79410a3747db379d11eb5c1a88d205fb65a92a200f079908b
TLSH
T1F9E05553A29EC2CE3080C247679D9DBF5F31723949465CA47324E4F48F1EA246EB8892
MD5 SHA1 SHA512 TLSH

Submit Download

motumseriesupdate.inf_amd64_32bae345c380de15.ini

Path C:\Windows\System32\DriverStore\FileRepository\motumseriesupdate.inf_amd64_32bae345c380de15.ini
Size 333B
SHA256 bac9749bfb1c5c6de6cb245549f308b7558b02573d517314de5ff6619396135f
MD5 0030057561333e0d6e057dc75b89ba8a
SHA1 7d03cbdae8d66d8d8a4bf4f61bda1ac4bdee900e
SHA512 e8159ada7c0790b278eee59231979df541acd6688c6b8686704b64e30a357386d9a13713d2a6050c48410b23ab92354a2ff79f6596c4682dc11e87d822827e75
TLSH
T1E5E07D439B26C2EE74B1E85355B94D3B0410FB2B051F585A32837BA01F889575F2C4FA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4264-898-0x0000000000400000-0x0000000000708000-memory.dmp

Download

memory/4264-578-0x0000000000400000-0x0000000000708000-memory.dmp

Download

memory/4264-896-0x0000000000400000-0x0000000000708000-memory.dmp

Download

memory/4944-595-0x0000000006620000-0x0000000006660000-memory.dmp

Download

memory/4944-616-0x0000000006EC0000-0x0000000006F52000-memory.dmp

Download

memory/4944-857-0x0000000007B30000-0x0000000007B38000-memory.dmp

Download

memory/4944-608-0x00000000073A0000-0x000000000795A000-memory.dmp

Download

memory/4944-568-0x0000000000BF0000-0x0000000000E98000-memory.dmp

Download

memory/5780-488-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/5780-899-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/5780-577-0x0000000000400000-0x00000000004CC000-memory.dmp

Download