abf4aa9e7751835256e616a64c84c134061ab88ecb37de040746f90a1d82768d

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CloakBox.html
Size 326KB
Sample261024-tcm4pscv9q
SHA256 abf4aa9e7751835256e616a64c84c134061ab88ecb37de040746f90a1d82768d
MD5 46ca0ca89086e853ca7fe07bed7e79a8
SHA1 776cef522b19e4dff8a7ef3bafe9c07207fb1bc9
SHA512 bde0f6df91333e1fdc2275fd3154bb10da4ac42624876f115421664f31f20bb68faa70d8b2827c955b5fa0dc716e397db2da5c80c1c4c692fab9a0f5a1440fab
SSDEEP 3072:PYIgAkHnjzxQ6KSAeTK8He88aW+LN7uxRLlzglKpf2VpX:1gAkHnjzxQBSA8+88CN78Bpf2VpX
TLSH
T12B642B25E5D2607F682B8033F27F3318B73FA483A101C969BA1CC5D5AFD19862177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery ransomware

Malware Config

Signatures

Drops file in Drivers directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET29CD.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET29CD.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\AtdtUSBMon.sys	MsiExec.exe
File opened for modification	C:\Windows\System32\drivers\SET1CDB.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET2373.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET2373.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\AtdtSup.sys	MsiExec.exe
File created	C:\Windows\System32\drivers\SET1CDB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\AtdtSup.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET26ED.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET26ED.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\AtdtUSBMon.sys	DrvInst.exe

Loads dropped DLL 16 IoCs

pid	Process
4336	MsiExec.exe
4336	MsiExec.exe
4336	MsiExec.exe
4336	MsiExec.exe
2260	MsiExec.exe
2260	MsiExec.exe
2260	MsiExec.exe
2260	MsiExec.exe
2260	MsiExec.exe
564	MsiExec.exe
564	MsiExec.exe
564	MsiExec.exe
564	MsiExec.exe
564	MsiExec.exe
564	MsiExec.exe
564	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	CloakBox.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	CloakBox.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	CloakBox.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	CloakBox.exe
File opened (read-only)	\??\P:	CloakBox.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	CloakBox.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	CloakBox.exe
File opened (read-only)	\??\S:	CloakBox.exe
File opened (read-only)	\??\W:	CloakBox.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	CloakBox.exe
File opened (read-only)	\??\Q:	CloakBox.exe
File opened (read-only)	\??\R:	CloakBox.exe
File opened (read-only)	\??\U:	CloakBox.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	CloakBox.exe
File opened (read-only)	\??\E:	CloakBox.exe
File opened (read-only)	\??\G:	CloakBox.exe
File opened (read-only)	\??\O:	CloakBox.exe
File opened (read-only)	\??\X:	CloakBox.exe
File opened (read-only)	\??\Z:	CloakBox.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	CloakBox.exe
File opened (read-only)	\??\K:	CloakBox.exe
File opened (read-only)	\??\N:	CloakBox.exe
File opened (read-only)	\??\T:	CloakBox.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40415c9e-82b7-614d-8a95-34f3da810ae0}\AtdtSup.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40415c9e-82b7-614d-8a95-34f3da810ae0}\AtdtSup.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{40415c9e-82b7-614d-8a95-34f3da810ae0}\SET1AAB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40415c9e-82b7-614d-8a95-34f3da810ae0}\AtdtSup.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{495007ab-d8bb-224a-9de8-81c6cf34b235}\SET2662.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{495007ab-d8bb-224a-9de8-81c6cf34b235}\SET2662.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40415c9e-82b7-614d-8a95-34f3da810ae0}\SET1AAA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5ba2e1a-37cc-1747-ae34-7aea85b537ee}\SET24CA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5ba2e1a-37cc-1747-ae34-7aea85b537ee}\AtdtUSB.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5ba2e1a-37cc-1747-ae34-7aea85b537ee}\SET24CC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{495007ab-d8bb-224a-9de8-81c6cf34b235}\AtdtUSBMon.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\atdtusbmon.inf_amd64_72b98e32227e1b67\AtdtUSBMon.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{495007ab-d8bb-224a-9de8-81c6cf34b235}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a5ba2e1a-37cc-1747-ae34-7aea85b537ee}\SET24CC.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\atdtusb.inf_amd64_c44b814f69285c9c\AtdtUSB.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{495007ab-d8bb-224a-9de8-81c6cf34b235}\SET2663.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\atdtusbmon.inf_amd64_72b98e32227e1b67\AtdtUSBMon.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40415c9e-82b7-614d-8a95-34f3da810ae0}\SET1AAB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\atdtsup.inf_amd64_c513e5dcdc45a303\AtdtSup.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5ba2e1a-37cc-1747-ae34-7aea85b537ee}\SET24CB.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a5ba2e1a-37cc-1747-ae34-7aea85b537ee}\SET24CB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5ba2e1a-37cc-1747-ae34-7aea85b537ee}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{495007ab-d8bb-224a-9de8-81c6cf34b235}\AtdtUSBMon.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{40415c9e-82b7-614d-8a95-34f3da810ae0}\SET1A99.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{40415c9e-82b7-614d-8a95-34f3da810ae0}\SET1AAA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\atdtsup.inf_amd64_c513e5dcdc45a303\AtdtSup.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{a5ba2e1a-37cc-1747-ae34-7aea85b537ee}\SET24CA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5ba2e1a-37cc-1747-ae34-7aea85b537ee}\AtdtUSB.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{495007ab-d8bb-224a-9de8-81c6cf34b235}\SET2661.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{495007ab-d8bb-224a-9de8-81c6cf34b235}\AtdtUSBMon.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{495007ab-d8bb-224a-9de8-81c6cf34b235}\SET2663.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\atdtusb.inf_amd64_c44b814f69285c9c\AtdtUSB.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{495007ab-d8bb-224a-9de8-81c6cf34b235}\SET2661.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40415c9e-82b7-614d-8a95-34f3da810ae0}\SET1A99.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\atdtsup.inf_amd64_c513e5dcdc45a303\AtdtSup.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{a5ba2e1a-37cc-1747-ae34-7aea85b537ee}\AtdtUSB.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\atdtusb.inf_amd64_c44b814f69285c9c\AtdtUSB.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\atdtusbmon.inf_amd64_72b98e32227e1b67\AtdtUSBMon.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{40415c9e-82b7-614d-8a95-34f3da810ae0}	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Vektor T13\VirtualBox\License_en_US.rtf	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxHeadless.exe	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VirtualBox_150px.png	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_bg.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\sqldrivers\qsqlite.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\fedora_ks.cfg	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\ubuntu_autoinstall_user_data	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxC.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxCAPI.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxSDS.exe	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxSVC.exe	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_zh_CN.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\debian_postinstall.sh	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxHostChannel.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VirtualBoxVM.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VirtualBoxVM.exe	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\dtrace\testcase\amd64\vbox-vm-struct-test.d	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_cs.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_nl.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_sl.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxRT.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxDD.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VMMR0.r0	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_ca.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_en.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\tzdata.txt	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\ubuntu_autoinstall_meta_data	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\rhel3_ks.cfg	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\x86\VBoxClient-x86.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\x86\VBoxRT-x86.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\drivers\USB\device\AtdtUSB.cat	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxDrvInst.exe	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxGuestPropSvc.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\dtrace\lib\amd64\vbox-arch-types.d	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_hu.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_ca.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\drivers\USB\filter\AtdtUSBMon.sys	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\Qt6Widgets.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_fr.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_bg.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_ru.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VirtualBox.VisualElementsManifest.xml	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_uk.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_es.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxGuestControlSvc.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\DbgPlugInDiggers.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\Qt6PrintSupport.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\Qt6StateMachine.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_cs.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_eu.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\Qt6Gui.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxDD2.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\redhat67_ks.cfg	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\drivers\network\netadp6\VBoxNetAdp6.sys	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\drivers\network\netlwf\VBoxNetLwf.cat	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\drivers\network\netlwf\VBoxNetLwf.inf	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\drivers\USB\device\AtdtUSB.inf	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxDDU.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_sk.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_ja.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\VBoxDragAndDropSvc.dll	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\VirtualBox_ja.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\nls\qt_uk.qm	msiexec.exe
File created	C:\Program Files\Vektor T13\VirtualBox\UnattendedTemplates\ol8_ks.cfg	msiexec.exe

Drops file in Windows directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIFB0E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDA0.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem5.inf	DrvInst.exe
File created	C:\Windows\INF\oem0.PNF	MsiExec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI23BA.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI2409.tmp	msiexec.exe
File created	C:\Windows\Installer\e5aec65.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF9E2.tmp	msiexec.exe
File created	C:\Windows\INF\oem4.PNF	MsiExec.exe
File created	C:\Windows\Installer\{562E2E1E-5C55-4502-B230-738EE218D753}\IconVirtualBox	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA8F.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12A.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIFAFD.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI260E.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIFB5D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI2A06.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{562E2E1E-5C55-4502-B230-738EE218D753}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID03.tmp	msiexec.exe
File created	C:\Windows\INF\oem1.PNF	MsiExec.exe
File created	C:\Windows\INF\oem2.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI1959.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\{562E2E1E-5C55-4502-B230-738EE218D753}\IconVirtualBox	msiexec.exe
File opened for modification	C:\Windows\Installer\e5aec65.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CloakBox.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3552	msedge.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000095d3837de88660fc0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000095d3837d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090095d3837d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a95d3837d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d95d3837d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{01510F40-C196-4D26-B8DB-4C8C389F1F82}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{101AE042-1A29-4A19-92CF-02285773F3B5}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21637B0E-34B8-42D3-ACFB-7E96DAF77C22}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{24EEF068-C380-4510-BC7C-19314A7352F1}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1D89E2B3-C6EA-45B6-9D43-DC6F70CC9F02}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2514881B-23D0-430A-A7FF-7ED7F05534BC}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0FE2DA40-5637-472A-9736-72019EABD7DE}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{243829CB-15B7-42A4-8664-7AA4E34993DA}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{245D88BD-800A-40F8-87A6-170D02249A55}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{245D88BD-800A-40F8-87A6-170D02249A55}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00892186-A4AF-4627-B21F-FC561CE4473C}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0FE2DA40-5637-472A-9736-72019EABD7DE}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{101AE042-1A29-4A19-92CF-02285773F3B5}\NumMethods\ = "13"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{14C2DB8A-3EE4-11E9-B872-CB9447AAD965}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{179F8647-319C-4E7E-8150-C5837BD265F6}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1F99D9DC-C144-4C28-9F88-E6F488DB5441}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1F99D9DC-C144-4C28-9F88-E6F488DB5441}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\AppID = "{61FF179A-5F10-4077-81F4-060BEBA09DEC}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\ = "Session Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01510F40-C196-4D26-B8DB-4C8C389F1F82}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0DE887F2-B7DB-4616-AAC6-CFB94D89BA78}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13EE6EB4-06FE-406B-AD69-F6E08B0587A3}\ = "IGraphicsAdapter"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E775EA3-9070-4F9C-B0D5-53054496DBE0}\ = "IMousePointerShape"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{21637B0E-34B8-42D3-ACFB-7E96DAF77C22}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{22363CFC-07DA-41EC-AC4A-3DD99DB35594}\NumMethods\ = "44"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{00727A73-000A-4C4A-006D-E7D300351186}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{024F00CE-6E0B-492A-A8D0-968472A94DC7}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{13EE6EB4-06FE-406B-AD69-F6E08B0587A3}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E8D3F27-B45C-48AE-8B36-D35E83D207AA}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21637B0E-34B8-42D3-ACFB-7E96DAF77C22}\NumMethods\ = "14"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{243829CB-15B7-42A4-8664-7AA4E34993DA}\NumMethods\ = "19"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{245D88BD-800A-40F8-87A6-170D02249A55}\NumMethods\ = "21"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{24EEF068-C380-4510-BC7C-19314A7352F1}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\AppID = "{61FF179A-5F10-4077-81F4-060BEBA09DEC}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{61FF179A-5F10-4077-81F4-060BEBA09DEC}\ = "VirtualBox Application\n "	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13EE6EB4-06FE-406B-AD69-F6E08B0587A3}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{181DFB55-394D-44D3-9EDB-AF2C4472C40A}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{181DFB55-394D-44D3-9EDB-AF2C4472C40A}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1D89E2B3-C6EA-45B6-9D43-DC6F70CC9F02}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1E775EA3-9070-4F9C-B0D5-53054496DBE0}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32\ThreadingModel = "Free"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00892186-A4AF-4627-B21F-FC561CE4473C}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01510F40-C196-4D26-B8DB-4C8C389F1F82}\ = "IVirtualSystemDescription"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{081FC833-C6FA-430E-6020-6A505D086387}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1E8D3F27-B45C-48AE-8B36-D35E83D207AA}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2405F0E5-6588-40A3-9B0A-68C05BA52C4B}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{0B108B8C-62E0-4E06-9DFA-2F1A2AD70774}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{179F8647-319C-4E7E-8150-C5837BD265F6}\NumMethods\ = "20"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{21637B0E-34B8-42D3-ACFB-7E96DAF77C22}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2405F0E5-6588-40A3-9B0A-68C05BA52C4B}\ = "IGuestProcessEvent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{243829CB-15B7-42A4-8664-7AA4E34993DA}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{00892186-A4AF-4627-B21F-FC561CE4473C}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{00F4A8DC-0002-4B81-0077-1DCB004571BA}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{081FC833-C6FA-430E-6020-6A505D086387}\ = "IFsObjInfo"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{11BE93C7-A862-4DC9-8C89-BF4BA74A886A}\ = "IMediumFormat"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{1474BB3A-F096-4CD7-A857-8D8E3CEA7331}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F99D9DC-C144-4C28-9F88-E6F488DB5441}\NumMethods\ = "19"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{232E9151-AE84-4B8E-B0F3-5C20C35CAAC9}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{07541941-8079-447A-A33E-47A69C7980DB}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0CA2ADBA-8F30-401B-A8CD-FE31DBE839C0}\NumMethods\ = "12"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{232E9151-AE84-4B8E-B0F3-5C20C35CAAC9}\TypeLib\Version = "1.3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{2405F0E5-6588-40A3-9B0A-68C05BA52C4B}\TypeLib	msiexec.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3808	NOTEPAD.EXE
5132	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
5480	msiexec.exe
5480	msiexec.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6044	CloakBox.exe
Token: SeIncreaseQuotaPrivilege	6044	CloakBox.exe
Token: SeSecurityPrivilege	5480	msiexec.exe
Token: SeCreateTokenPrivilege	6044	CloakBox.exe
Token: SeAssignPrimaryTokenPrivilege	6044	CloakBox.exe
Token: SeLockMemoryPrivilege	6044	CloakBox.exe
Token: SeIncreaseQuotaPrivilege	6044	CloakBox.exe
Token: SeMachineAccountPrivilege	6044	CloakBox.exe
Token: SeTcbPrivilege	6044	CloakBox.exe
Token: SeSecurityPrivilege	6044	CloakBox.exe
Token: SeTakeOwnershipPrivilege	6044	CloakBox.exe
Token: SeLoadDriverPrivilege	6044	CloakBox.exe
Token: SeSystemProfilePrivilege	6044	CloakBox.exe
Token: SeSystemtimePrivilege	6044	CloakBox.exe
Token: SeProfSingleProcessPrivilege	6044	CloakBox.exe
Token: SeIncBasePriorityPrivilege	6044	CloakBox.exe
Token: SeCreatePagefilePrivilege	6044	CloakBox.exe
Token: SeCreatePermanentPrivilege	6044	CloakBox.exe
Token: SeBackupPrivilege	6044	CloakBox.exe
Token: SeRestorePrivilege	6044	CloakBox.exe
Token: SeShutdownPrivilege	6044	CloakBox.exe
Token: SeDebugPrivilege	6044	CloakBox.exe
Token: SeAuditPrivilege	6044	CloakBox.exe
Token: SeSystemEnvironmentPrivilege	6044	CloakBox.exe
Token: SeChangeNotifyPrivilege	6044	CloakBox.exe
Token: SeRemoteShutdownPrivilege	6044	CloakBox.exe
Token: SeUndockPrivilege	6044	CloakBox.exe
Token: SeSyncAgentPrivilege	6044	CloakBox.exe
Token: SeEnableDelegationPrivilege	6044	CloakBox.exe
Token: SeManageVolumePrivilege	6044	CloakBox.exe
Token: SeImpersonatePrivilege	6044	CloakBox.exe
Token: SeCreateGlobalPrivilege	6044	CloakBox.exe
Token: SeCreateTokenPrivilege	6044	CloakBox.exe
Token: SeAssignPrimaryTokenPrivilege	6044	CloakBox.exe
Token: SeLockMemoryPrivilege	6044	CloakBox.exe
Token: SeIncreaseQuotaPrivilege	6044	CloakBox.exe
Token: SeMachineAccountPrivilege	6044	CloakBox.exe
Token: SeTcbPrivilege	6044	CloakBox.exe
Token: SeSecurityPrivilege	6044	CloakBox.exe
Token: SeTakeOwnershipPrivilege	6044	CloakBox.exe
Token: SeLoadDriverPrivilege	6044	CloakBox.exe
Token: SeSystemProfilePrivilege	6044	CloakBox.exe
Token: SeSystemtimePrivilege	6044	CloakBox.exe
Token: SeProfSingleProcessPrivilege	6044	CloakBox.exe
Token: SeIncBasePriorityPrivilege	6044	CloakBox.exe
Token: SeCreatePagefilePrivilege	6044	CloakBox.exe
Token: SeCreatePermanentPrivilege	6044	CloakBox.exe
Token: SeBackupPrivilege	6044	CloakBox.exe
Token: SeRestorePrivilege	6044	CloakBox.exe
Token: SeShutdownPrivilege	6044	CloakBox.exe
Token: SeDebugPrivilege	6044	CloakBox.exe
Token: SeAuditPrivilege	6044	CloakBox.exe
Token: SeSystemEnvironmentPrivilege	6044	CloakBox.exe
Token: SeChangeNotifyPrivilege	6044	CloakBox.exe
Token: SeRemoteShutdownPrivilege	6044	CloakBox.exe
Token: SeUndockPrivilege	6044	CloakBox.exe
Token: SeSyncAgentPrivilege	6044	CloakBox.exe
Token: SeEnableDelegationPrivilege	6044	CloakBox.exe
Token: SeManageVolumePrivilege	6044	CloakBox.exe
Token: SeImpersonatePrivilege	6044	CloakBox.exe
Token: SeCreateGlobalPrivilege	6044	CloakBox.exe
Token: SeCreateTokenPrivilege	6044	CloakBox.exe
Token: SeAssignPrimaryTokenPrivilege	6044	CloakBox.exe
Token: SeLockMemoryPrivilege	6044	CloakBox.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
6044	CloakBox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 5948 wrote to memory of 5824	5948	msedge.exe	86
PID 5948 wrote to memory of 3552	5948	msedge.exe	88
PID 5948 wrote to memory of 3224	5948	msedge.exe	89
PID 5948 wrote to memory of 2468	5948	msedge.exe	90
PID 5948 wrote to memory of 3224	5948	msedge.exe	89
PID 5948 wrote to memory of 3224	5948	msedge.exe	89
PID 5948 wrote to memory of 2468	5948	msedge.exe	90
PID 5948 wrote to memory of 2092	5948	msedge.exe	91
PID 5948 wrote to memory of 2092	5948	msedge.exe	91
PID 5948 wrote to memory of 2092	5948	msedge.exe	91
PID 5948 wrote to memory of 5668	5948	msedge.exe	92
PID 5948 wrote to memory of 5668	5948	msedge.exe	92
PID 5948 wrote to memory of 5668	5948	msedge.exe	92
PID 5948 wrote to memory of 2032	5948	msedge.exe	94
PID 5948 wrote to memory of 2032	5948	msedge.exe	94
PID 5948 wrote to memory of 2032	5948	msedge.exe	94
PID 5948 wrote to memory of 2384	5948	msedge.exe	95
PID 5948 wrote to memory of 2384	5948	msedge.exe	95
PID 5948 wrote to memory of 2384	5948	msedge.exe	95
PID 5948 wrote to memory of 5408	5948	msedge.exe	100
PID 5948 wrote to memory of 5408	5948	msedge.exe	100
PID 5948 wrote to memory of 5408	5948	msedge.exe	100
PID 5948 wrote to memory of 1172	5948	msedge.exe	101
PID 5948 wrote to memory of 1172	5948	msedge.exe	101
PID 5948 wrote to memory of 1172	5948	msedge.exe	101
PID 5948 wrote to memory of 5984	5948	msedge.exe	104
PID 5948 wrote to memory of 5984	5948	msedge.exe	104
PID 5948 wrote to memory of 5984	5948	msedge.exe	104
PID 5948 wrote to memory of 5744	5948	msedge.exe	103
PID 5948 wrote to memory of 5744	5948	msedge.exe	103
PID 5948 wrote to memory of 3092	5948	msedge.exe	105
PID 5948 wrote to memory of 3092	5948	msedge.exe	105
PID 5948 wrote to memory of 3092	5948	msedge.exe	105
PID 5948 wrote to memory of 4000	5948	msedge.exe	110
PID 5948 wrote to memory of 1684	5948	msedge.exe	111
PID 5948 wrote to memory of 2992	5948	msedge.exe	112
PID 5948 wrote to memory of 3396	5948	msedge.exe	114
PID 5948 wrote to memory of 3372	5948	msedge.exe	115
PID 5948 wrote to memory of 3372	5948	msedge.exe	115
PID 5948 wrote to memory of 3372	5948	msedge.exe	115
PID 5948 wrote to memory of 1224	5948	msedge.exe	116
PID 5948 wrote to memory of 1224	5948	msedge.exe	116
PID 5948 wrote to memory of 2336	5948	msedge.exe	117
PID 5948 wrote to memory of 2336	5948	msedge.exe	117
PID 5948 wrote to memory of 2180	5948	msedge.exe	119
PID 5948 wrote to memory of 5096	5948	msedge.exe	123
PID 5948 wrote to memory of 5096	5948	msedge.exe	123
PID 5480 wrote to memory of 4336	5480	msiexec.exe	131
PID 5948 wrote to memory of 1368	5948	msedge.exe	132
PID 5948 wrote to memory of 1368	5948	msedge.exe	132
PID 5948 wrote to memory of 4252	5948	msedge.exe	135
PID 5480 wrote to memory of 4528	5480	msiexec.exe	138
PID 5480 wrote to memory of 2260	5480	msiexec.exe	140
PID 5480 wrote to memory of 564	5480	msiexec.exe	141
PID 2480 wrote to memory of 3536	2480	svchost.exe	143
PID 2480 wrote to memory of 4012	2480	svchost.exe	144
PID 2480 wrote to memory of 5644	2480	svchost.exe	146
PID 2480 wrote to memory of 4520	2480	svchost.exe	147
PID 2480 wrote to memory of 4016	2480	svchost.exe	149

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\CloakBox.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x234,0x264,0x7fffeadbc188,0x7fffeadbc194,0x7fffeadbc1a0
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,4321792520059468316,16541027453770536337,524288 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,1019963246394576103,239015603362104651,262144 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:2
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,14554171948913528023,2832657465668188140,524288 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,6288898654199781143,15004503646419337682,2097152 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,12406078206909406708,14638406580299835367,2097152 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4924,i,15092066790196725560,14977051492385738940,2097152 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5108,i,2091071710431841178,12228280489850235713,2097152 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5688,i,15021532291323130299,14721841324142509139,2097152 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5800,i,5375756623208501305,17177566803923731524,2097152 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,14627058719207964905,5730487062547602966,524288 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5724,i,12800753996013054692,3381301153842319709,2097152 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:5984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6420,i,2713148703237743717,17904722166079029315,2097152 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,7766945558078805879,448829481532556648,524288 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,3200634026132856185,7833170587207629384,524288 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,3669445977851445882,4308847396837897823,524288 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,18224726937045520067,323263030997833935,524288 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6072,i,12668761355072968726,3847316305994638816,2097152 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,12364300561833234189,1969093523124904550,524288 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,15442167139245677898,10236660468754396911,524288 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,14893475500690176633,4584790929316969780,524288 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:8
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,14893475500690176633,4584790929316969780,524288 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,13752746747571913418,15021254996221448424,524288 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7220,i,2933757137010210618,9413481522333535077,524288 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4876,i,3647288000568085206,227204587179189312,262144 --field-trial-handle=2820,i,13048400331732675962,4809421442002608289,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5992

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4740

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_CloakBox.zip\CloakBox\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3808

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_CloakBox.zip\CloakBox\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5132

C:\Users\Admin\AppData\Local\Temp\Temp1_CloakBox.zip\CloakBox\Install Cloakbox\CloakBox.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_CloakBox.zip\CloakBox\Install Cloakbox\CloakBox.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6044

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5480
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1162AA0DA84BD020CA4C0F7EAEF91EA9 C
  2⤵
  - Loads dropped DLL
  PID:4336
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4528
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 2D7754D9BD80BFF805E5F8C1631282B4
  2⤵
  - Loads dropped DLL
  PID:2260
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 40928F0643DAF920D2A6562463663011 E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{57f06977-4d30-4744-a13c-fa1193c0ccb1}\AtdtSup.inf" "9" "414a5fe33" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files\Vektor T13\VirtualBox\drivers\atdtsup"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3536
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "14" "C:\Windows\System32\DriverStore\FileRepository\atdtsup.inf_amd64_c513e5dcdc45a303\atdtsup.inf" "0" "414a5fe33" "000000000000015C" "WinSta0\Default"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  PID:4012
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7a663502-c51d-4d4d-a960-0972d57ac610}\AtdtUSB.inf" "9" "43db8d543" "0000000000000160" "WinSta0\Default" "0000000000000100" "208" "C:\Program Files\Vektor T13\VirtualBox\drivers\USB\device"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5644
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{fda75576-849a-ac4b-a09e-adae33427fee}\AtdtUSBMon.inf" "9" "4f2a93517" "0000000000000180" "WinSta0\Default" "0000000000000100" "208" "C:\Program Files\Vektor T13\VirtualBox\drivers\USB\filter"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4520
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "14" "C:\Windows\System32\DriverStore\FileRepository\atdtusbmon.inf_amd64_72b98e32227e1b67\atdtusbmon.inf" "0" "4f2a93517" "0000000000000100" "WinSta0\Default"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  PID:4016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AtdtSup.cat

Path C:\PROGRA~1\VEKTOR~1\VIRTUA~1\drivers\atdtsup\AtdtSup.cat
Size 11KB
SHA256 a29dbb04b7ad1951d288ddab0e080b490a3a40f97123917bae683556521ea698
MD5 7210f738138126e1aafe68ac78b76d56
SHA1 563580ef2bc2902ef825323fa200a4a20de63cad
SHA512 6a68073aa476ddd6c61900d174beaab7e013b1b57ea0df836962c8949c76af7d48766fce807cdcd869834282860a821c68976e3bccb9076a6abe9615a754d1ad
SSDEEP 192:w54Uw0TkMbhJCePghXDEwXEhYCkMWXYz1X01k9z3AcWyl2TP2T:Arhiyh3aoJR9zbk0
TLSH
T1CB4218E6956C4082FDA77CA053E8F9933C3927CB9910606536EEE74C1DA33C9E72422D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AtdtSup.sys

Path C:\PROGRA~1\VEKTOR~1\VIRTUA~1\drivers\atdtsup\AtdtSup.sys
Size 1.0MB
SHA256 7ef6f19dc52316675655e66587f6cc3f65ef948ac1b6014ee08fea74170b9fdd
MD5 d30d5a7e6e459d19bc7dfc68a0af5d66
SHA1 0069d8ae93ebd28a2350a6694d9fd616b35e50db
SHA512 3623c25a0f4670ab434f8a2aa98f90df7175b13b29c93d8e17f98e09fa2228ec932bd6c6882b809b20415be44a36597a4a03b6795706bd8be4c8801ed0115676
SSDEEP 12288:3om+ljkJkxRfUnS3H1sHTQCtVektqfIeInBF7wNSAs5FtNy:YmujkJUunmH1fCreuaHInsTmy
TLSH
T150359F8EB6A409F6C5AB8138C2C14626D2B678011760C7EF06E697B51EB3FD61E3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VirtualBox.exe

Path C:\Program Files\Vektor T13\VirtualBox\VirtualBox.exe
Size 3.0MB
SHA256 467cc631d12c906b21578298de87c8152b42aa6c7a7b79b61292b7614f694860
MD5 a542977eae157c2a5d3e21015b49d3d4
SHA1 147e107e06f82cee96f145a88c86c96890d6245b
SHA512 329a71c394e899c356fd903af19340ddc9c2847a1651e21fbd2f5b3e766e481f55cd89a04317f7a4014fc3670443e64c9659973cd0319528b72be3cb9a1a87b3
SSDEEP 49152:bQtHPMaISOV9GepurE1AVUj8kIhqHpt0wauHG5hL12iQbg:IOxy2C
TLSH
T127E54A5BE39901E1F4F9C07DCA4B4617EA727006032357EB11668E2A6FB77E24E3D690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AtdtSup.inf

Path C:\Program Files\Vektor T13\VirtualBox\drivers\atdtsup\AtdtSup.inf
Size 1KB
SHA256 7c94022686475d0d2767a22973b75d19231382971b874617f99fb3bdab683bc8
MD5 2e2ecc213f81154f276ead823f7f02d1
SHA1 6de75a7c023372fe547f72800007c22f14cebc41
SHA512 3aef9d8392ad64ef57ef260c47bf87507b655f7ceaf2e8026960372784cede48841f10b16c630b42fc40c421e3a04cfdd2098f01e6b38f26639f12accc1d6d89
TLSH
T11621D0B2D84542B0786B2FD73E5BA182E3D4301128EA6D59F1DF8002D7E591C8F2D6E6
MD5 SHA1 SHA512 TLSH

Submit Download

03B6193231D6872FDA0CFE8EF2B47341_7C9B879D52D6918D5A01C326C7A6A2A6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\03B6193231D6872FDA0CFE8EF2B47341_7C9B879D52D6918D5A01C326C7A6A2A6
Size 727B
SHA256 9eec90e8ea147a0850edf25d3e01259fa25224c9dc1d40d83bccb97d1b14a4b1
MD5 28a3f03b7b25667e7486dc4df4b9d5f4
SHA1 730bfce69f8a0d2d290d7711eb56958d22e7cedb
SHA512 f86ed4af259ea57407c339a51e9306dab0727fc9e2e95f40f940b71dd033c07d9f9be192266f173cb157400542ab2457c2eec6f704d22f3b9420e526316ab886
TLSH
T1310115AA987D5CC57D514888ADECC26DB6B5A81096F0045FA5A87C4A7844FA15F10413
MD5 SHA1 SHA512 TLSH

Submit Download

2A7611428D62805A3E4E5BC4103D82E4_5DFDB51029B86E246C6BBA4B4F208E9A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2A7611428D62805A3E4E5BC4103D82E4_5DFDB51029B86E246C6BBA4B4F208E9A
Size 471B
SHA256 33e131b3ac04bd0f28d56b952929cde772b68f0e6e9a4f8554bec24f21a39648
MD5 9eddca30e5b2269d76545b82c56781d5
SHA1 9ebddedcb98269351753784e8045f66f4391bfe0
SHA512 2677587cdd56847b14714edcc744f84ca6f0f5584a0d563ae146bc926439204b2c3bee3668e54590322ed0f07882bdab54fbbcd2371e22a3eace7ceffea92240
TLSH
T1E1F0D413FF5E2CD13500AD14B88415E53507A2F101E755B979D419D1856C3679C4C224
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 835e9be2b8d2d214a2702f3a8d5b7612724a634004e528d5d0b8287fc68913dd
MD5 71d1eb07d558d995da8100417543a2b5
SHA1 05d1d35fc2f173b4948c24e36f498736d47b8430
SHA512 5970236e6b9f949a33032e144317efc884eb6073fc3642d6a235bae4939becb3490d4d19eafe13c2d813be7ddb7bf20428ae5b9c2f53f2ae3beee9b5cefd4dda
TLSH
T134F0D47FDCBC38B1590E547C3DFDC6507CA0A04C48A3443936BD38E45957A92AB5E81D
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_B60E2B15CE7688A988CAACF7F569B2DE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_B60E2B15CE7688A988CAACF7F569B2DE
Size 727B
SHA256 36b02004992a6a0fdb8dcb342f254e033c342fc2152eb4eb075de9dfd7856f1c
MD5 fcdd703781b4f67697040d0baef0e2a2
SHA1 55ce7a6ebbac3fb9b560d53cb83bbd3d15550055
SHA512 9352e3da662e402d4d1143b41ce93506a991f1b1702a23f78a671641217dccd4e97b951d8a9cf1b6b4a665454348aa5d30d08f511262e3d822726a299c86f621
TLSH
T14A014903DCF5BAC07DC1C9477AD4816CB35741F8C68F88075A551AC60994995EF7B443
MD5 SHA1 SHA512 TLSH

Submit Download

03B6193231D6872FDA0CFE8EF2B47341_7C9B879D52D6918D5A01C326C7A6A2A6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\03B6193231D6872FDA0CFE8EF2B47341_7C9B879D52D6918D5A01C326C7A6A2A6
Size 404B
SHA256 5d9514d54494d789e108ba60cf5fc12292c8ab5b6508cad038a1db7d3135dd95
MD5 457f00e702c8da48c31ab4d3ee83c633
SHA1 a3b0e0d11e7ef35ed566b96215e1f587b9cbeb6d
SHA512 ce4f70b4623e64a2644eba4cd50670aff2eda759a3aef8ec50a34ef6727b5e527ead464d5ddf10e30d608ed39b7f3d335e106dadf8c6b8335dafeb465f47efcf
TLSH
T1FFE0C028517E416CF0B2DD3809CDA9E9486DD201581DD1B11AE0030FDE07B400D12876
MD5 SHA1 SHA512 TLSH

Submit Download

2A7611428D62805A3E4E5BC4103D82E4_5DFDB51029B86E246C6BBA4B4F208E9A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A7611428D62805A3E4E5BC4103D82E4_5DFDB51029B86E246C6BBA4B4F208E9A
Size 400B
SHA256 2d3433c28f8c7aefeeb6591a0a533c1cf13c8c0fa72e531e83a0757d47d2fe92
MD5 97cb198f4eaacd931c86c3ba65286cac
SHA1 b3340f783887a411701471909b0a8ee4addd8943
SHA512 97b22d765e2961b38196781d308714478994a93bd767d5ed07f15de0074e7d48d17e754998156c6d1eaea3a107e4a1b0ac32c426e344c730cc6ed9c6604f851b
TLSH
T1D5E0203851E6021EF0F2597E8DDE72368D6CE32A084A1B7419D05604E7057C15C52D76
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 d048ef2629c36c7be6f0d1acfdb90211b429e2e88987863c771c560a9179b19f
MD5 7e08b3248e14d5545a3a67e567800dd2
SHA1 c831ee471af3d61257e65dc819025a464d3b89c9
SHA512 82140d3b9eebb79a8c77437a7d7c62cbf6f175429bff154f87a5c33d22e232a7f676f2245634b406dd40040dc919ed7703ffee891f52cc8feb970a69e258ceaf
TLSH
T169E0202017FA116EF2709B7443D590A55F26F1133D49A6BE1E91551EA90AD005C56C31
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_B60E2B15CE7688A988CAACF7F569B2DE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_B60E2B15CE7688A988CAACF7F569B2DE
Size 412B
SHA256 75aa06bc49ce4623edb8eb30ed55462b12298a36e33120f7c901d063b12de834
MD5 9bb4c5feaf6779e2d8272dea8ce78cac
SHA1 f381a551b8beb1025e981602b1abf496fe607e03
SHA512 746437860dba0017555be1a7940abbd4e70faa67b763d04fee3cfb25459418ca8d2a054aeea1d1d2b0654fa9e663357e54eedf827452524ae7c97855085078ac
TLSH
T1C3E026382AEA559EF1709E3446F9F1759958F31948489ABD2A814319BB0BF00AC18AF8
MD5 SHA1 SHA512 TLSH

Submit Download

06951ba4-b84f-4757-802e-58d2d4ca2477.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\06951ba4-b84f-4757-802e-58d2d4ca2477.tmp
Size 25KB
SHA256 f7d6b055dc02d32742f2698ac2a0e29ac58af285be3975613f91ead0a3783db1
MD5 55afe4d0eaff5944186b1f7604423d3a
SHA1 cb6a4a7925802aa956bdb9501de1ae31a822ee42
SHA512 bcb1c78261cdb34121e5ccf903f41d32603bdd26f8212a73f679901267bef5316855c6b9b934bcb6549367ee1dceee99ff30d65568243aaf4ac25dc5af82e6e6
SSDEEP 384:nkiFiZcIB3sN28TUNTUlI4MaKMWu2w2f0BCcD/1XSU1uDi0XHWgL/7IzfoQ:/FQB3nwgqPjBCy/1isEi0XHU3
TLSH
T18BC23A72ECA4DDABECEA8BD5A34A7A03DEE40163D5DC9AC4D9DC5D1C009719D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a41c275-9d16-43ea-842f-984406dee10f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0a41c275-9d16-43ea-842f-984406dee10f.tmp
Size 26KB
SHA256 bc0f681a4514a451f649a77a29815355f5b5adbb8e18d8664e55ced6beec1616
MD5 5934e5f63c3f925c8dadc41213ca2e7f
SHA1 d0aaff5083e776610526121b3c06dcd3a233c7e9
SHA512 8442d5c90b4004744638071b2dcf189fd34bb3cab4ac1ef83d0dcc8e1f243b57fd926b60417ae968a6050858bfed2c7738b8a2276e406ddfd276e6bf7f392c0c
SSDEEP 384:nxiFzQkUSvZ3sN28TUNTUlI42aKMyKi2w2f0BCcD/1XSU1uDi02IDu8gL/7IzbIC:YFdZ3nwgiOjBCy/1isEi05DuQLt
TLSH
T193C23832ECA5DEA7EDEA8FD4A34A3A43DEE00153D99C9AC8DAC91D5C00D719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76329ddf-0bac-4db2-9a33-e5ccef174e2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\76329ddf-0bac-4db2-9a33-e5ccef174e2b.tmp
Size 27KB
SHA256 7d9b913fbb908537759f1c013c7518e292ded5dcd406a06be9fa08d72b6268b0
MD5 548ef9b4ed8c94220330811cb248ad4f
SHA1 e4dfa248deacb2708e488315cdcbef1379ecc097
SHA512 499844e7662137c55e91f3f7f9f84aece084209cdaac4bf5b3207f215988b89d9d16a26a607f8e594837109a721d9c3d65c55639b008d9d87ffaa6c233b56856
SSDEEP 384:nxiFCQkUSvt3sN28TUNTUlI4iaKMYKi2w2f0BCcD/1XSU1uDi02IDu8gL/7IzbIC:YF6t3nwgOojBCy/1isEi05DuQLt
TLSH
T1DBC23832ECA5DEA7EDEA8ED4A34A3A43DEE00153D9DC9AC4DAC91D5C00D719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90799050-8df7-4d53-9fb5-592b93c743a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\90799050-8df7-4d53-9fb5-592b93c743a3.tmp
Size 27KB
SHA256 b61b53ab31f4f5ebf8e16b438937019917c69966cdefe8f9e0316b6ae2ecae0c
MD5 8e1025fa6d471b237132c932e0230148
SHA1 9f455f64ceb3f2b79f393c50565655dc6dec9222
SHA512 e849dd98bc20f5d3832b7abcec07d3512d496189b1843cb5259d00e9cb6a1e2620715ae8836c3041eb918d87331ba8d8bb179906d1cf0c42af6c3fbd4342364f
SSDEEP 384:nPiFCQkUSvZw3sN28TUNTUlI4iaKMYKi2w2f0BCcD/1XSU1ukm02IDu8gL/7IzbZ:aF6+3nwgOojBCy/1isJm05DuQLt
TLSH
T18AC22836ECA5DEA7EDEA8FD5A34A3A43DEE00153D99C9AC8DAC81D5C00D719D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bc826aaa75d7da810bfdc30a1671df54c18887a7ddc779d5b9f03835587852b4
MD5 77e198de5db1473b46a54bf11e90ef65
SHA1 d40423f0ddb590b81cb9016394df150361acaffc
SHA512 208c9def9ae2c86b2de012eeb71379c0f243edb53a958e991a05233405a4a20955e43cd9ddeb6944b19a1811ed512d3123f7d75ab4ca5b9a71dca6edca139ba2
TLSH
T1ADD08028B57C7BE4F03D353D0224414C31CD5AB156067545925417554FD155315D48E9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

0eb38c2e-ebde-4788-bf93-aae7f1d37b6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0eb38c2e-ebde-4788-bf93-aae7f1d37b6d.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6317ba03-28a8-47ce-b8df-1b333c7b3dd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6317ba03-28a8-47ce-b8df-1b333c7b3dd0.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

85fd309b-c68d-49d1-9ce9-1464dddb36e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\85fd309b-c68d-49d1-9ce9-1464dddb36e5.tmp
Size 12KB
SHA256 717432a31cc020b680745ccf92f3f81f708b6bae8524f56cd68603eae01bdd8b
MD5 15f198aa6ef32b0347cc38c5c4f006ab
SHA1 76aa481fab83aa07d7b368ec574c20f4c7a629ac
SHA512 83f7632a5f283c8926aa837b6b4b13a2b68a7c1bbb641ee3bc75d07f765d4b303d3b27ed7a1267a4999af16ba09a8fdefead23d2c8c95f0f13febc6baef806ae
SSDEEP 192:sxZTRPf6v/fcsGQZLA8RzodpbS3gyLHW6+WNLOilYopy2STVIg5R1tLJ:sxZTF6v/fcsGOrawHbpDbS9/1td
TLSH
T10A42E8566D38697B9CC7D219FA55BF53E2F9203290D11E88AAFC8A1C14E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90435314-30d8-41ab-bfa6-bc8126bae120.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90435314-30d8-41ab-bfa6-bc8126bae120.tmp
Size 414B
SHA256 d3ca075dd2ae5d843beb8f9b84793ab5980088d33c7aab753721bfb40b921686
MD5 ce4654c7ca46eca0dfda39c9d1b05817
SHA1 e58bb76a16b05b3ead871b960c3b5911cf054c31
SHA512 7e288e595663988df8dcb5be0be183c477fff9de55c360403b2d9c74ceb53246451b27044bd12aec5793fb4f54e9222a4ad3123e520b86a064221a7c59ea3ce7
TLSH
T105E02B6AC815EC3B18FE5B7864540745FB11236B2A419C4B3B3D800C9FF06374185C6C
MD5 SHA1 SHA512 TLSH

Submit Download

97391233-1e5c-43e8-8f36-18fe59ded997.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\97391233-1e5c-43e8-8f36-18fe59ded997.tmp
Size 12KB
SHA256 ade3ba4327bc6fc574d117e2c0435885f0652bcfc40fa3372032c37d900c7b2d
MD5 a2cf24a0db845cca6a488296b9a02314
SHA1 24d1602165f630a35627ffb3a4a0e283f66395dc
SHA512 9e384bd467d8acb0535412801ce765c6b0cd67252bae4e6f664c6f136ca18558a4668f0b9dc084a6a511ca702a5abe9308fd1fd1680efd37b3782489c2c5aaac
SSDEEP 192:sxZTRPf6v/fcsDaQZLA8RzodpbS3gyLHW6+WNLOilYoW2STVIg5R1tLJ:sxZTF6v/fcsGOrawHbpJS9/1td
TLSH
T14242D8566D38697B9CC7D219FA55BF53E2F9203290D11E88AAFC8A1C14E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f083293453daea8ceb48c60b7f2a72fce8c761e85e75542391e5b84a8ccbbe79
MD5 6880cff3d9df34b7806d00299221655c
SHA1 f03cbdd05f19457867682ab78c5acb65243da099
SHA512 d5f46c9e7253ebcabcc535fd2b985ebbbf8fb7b3a2249a1f5bb7d69756c14dde8d46bf8db2a768612d52de4c9ad8e5f47ba078a417c4fcf093bb888f6fb732f7
TLSH
T1F8E07DA404CAE23FA30864C7137CA78D8B90361FD3C8AD8E1B00CB85700E640B6C6AF5
MD5 SHA1 SHA512 TLSH

Submit Download

03d0909d-6c00-4f2b-9627-89a360f93001.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\03d0909d-6c00-4f2b-9627-89a360f93001.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

704b9c68-2038-4e3b-8ae9-315ac9e5458b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\704b9c68-2038-4e3b-8ae9-315ac9e5458b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dd3da0e0-3dff-4ce8-b4b7-fb0bc5561f1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dd3da0e0-3dff-4ce8-b4b7-fb0bc5561f1d.tmp
Size 7KB
SHA256 29c01bc5a7735127ca1c9b3b84f8edcb2689d782d5979fa1366ee61ead0c7408
MD5 fd852c0a436a70bb0aca228702ee5964
SHA1 f1771d9385c1ab970ac422604f37e91e0dfccbb4
SHA512 402144c8c443559389af89e1a495437bd651c8668faf272dd6552394e7e67be0b87f973c99382d5c134a961a20031d4e3ebcb9f0ec983da975bb6855f51a6ff7
SSDEEP 192:D1zP7IebgeeeDaaiZiH1ZmwZ7URQAZPjLAMULe07KKAOInK0SkERsGT:D1zP7IebgeeeDaaiZiH1ZmwZ7URQAZPU
TLSH
T1CBF1BCBBC6E4477E891252F09B24AD1ACE1D151B832C3C568DF8AE1F63E2571E14139F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5eadd90-f5da-4be0-87cc-3464558d8553.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e5eadd90-f5da-4be0-87cc-3464558d8553.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 964fdd9cb59804b4fdb5a15fd15774d1651dbba80c3292faf5df3255a506931f
MD5 e5b6328e50cfec4905652d43d7251f04
SHA1 d8b0481bfe6977fe0e0ae644f577aaea8a229d50
SHA512 ded317987225147ea19e99a9c5d15c9f2d5466d70b6cea9a7e5c1c4c7af6328d77b7b5951d97987c53be590b68e3b4a124bd3c5fd547caf2a086b5a2337498bb
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgW:ST/2dXOJhJlpfnpp3tNXVrN3g3Xz
TLSH
T164B23F1571BB021039FE391892B68B2E168271733119E66B7FBD44B68E67F085DFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b037792e-f9a6-4448-9ff9-33261a4546bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b037792e-f9a6-4448-9ff9-33261a4546bf.tmp
Size 12KB
SHA256 f92ee3e9129dcfe22e694cf67c6bff16fe02e76d90d3a9b9b1752f6e11649a36
MD5 24e6183b167e3a4b6dee80c116f2115b
SHA1 fc270d0fe4a13b7216eef0158e81dfadb219c139
SHA512 2d6cae960fa4fcc110b295597be87a179b44fba29b773de30301e30c8079f59c25d26ba2dc6237abe2d277000a62b727fd08ab6da205031910585ff509fb0ded
SSDEEP 192:sxZTRPdv/fcsGQZLA8RzodpbS3gyLHW6+WNLOilYopfWkISTVIg5R1tLJ:sxZTbv/fcsGOrawHbpDqS9/1td
TLSH
T1F142E8566D346D7B9CD7D219FA55BF53E2F9203290D10E88AAFC8A1C14EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecf411bc-6e51-4cb4-8b46-746a427fc8f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ecf411bc-6e51-4cb4-8b46-746a427fc8f9.tmp
Size 12KB
SHA256 6d38c1cea193b924b721dd6f6b6f134f9f8bd6205be4a69ced12874e85171726
MD5 33544ab8b745c58f6556140570ca1e7f
SHA1 dc61e0e57503d7681e04a65566f2bbd6d2adfb4b
SHA512 7d512b6d8dd9ceb52173b9a6b82af478b583b5c59b7ce53994fbb7e605672bebb832fd6e1165b2ea996c4f2bd0e62c23037ec64ae74f98719c6042902897fa7b
SSDEEP 192:sxZTRPf6v/fcseaQZLA8RzodpbS3gyLHW6+WNLJYoW2STVIgjtLJ:sxZTF6v/fcs3OrawHbtJS9jtd
TLSH
T1B042D8566D38693B4CC7D219FA56BF53E3F9203290D10E88AAFC8A1C14E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 499ffa9d572fad8e61aebcb0e7686b858bd87557b337ac80da71b9d7bd1579fb
MD5 daf9b941220ca8ee3070529a4e033010
SHA1 c5671297ace0ed52f1777e7043976450767494f1
SHA512 641434ba7798ed3487747ad83b6db033e5c9d34bb4fb4d0905b40cdfdab58c674a79dabe9c0a7dff0c534c8784604ca98c32547ac360e4621921b83122503401
SSDEEP 384:n/iFiZcI63sNE8TUNTUlIm2aKMif4w2f0BCcD/1XSU3Fh7O6R2FeoivgL/7IzIou:KFQ63VwgcwZBCy/1iyFh7TRXYx
TLSH
T16CC25B36ECA4DAABEDFB8FDAA74A7A03DEE00163959C85C0D9D81D1D009759D030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a890ce2b-d0b8-4230-93b4-668a43452961.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a890ce2b-d0b8-4230-93b4-668a43452961.tmp
Size 26KB
SHA256 b6fd943caaadaaad42f7c2dd07ab024458b6a16fa65d6424d7658d1fd3ff89e0
MD5 a8ae45347ad20a82b1fb841367f0bf61
SHA1 fe9e31b5d99590293a5c9c6f19ad8818161f83bd
SHA512 8ab12386fb6f546419980bed412d00b9688e756acf59cbab3d0495ab9f53afbc72ab900dd8e1092f191eba7e5560da19501f5f03cbf06a27208abcb3e952b108
SSDEEP 384:nEiFiZcI63sNa8TUNTUlIm2aKMdeVw2f0BCcD/1XSU1u4i07O6R2FeoivgL/7Izs:fFQ633wgc2cBCy/1isdi07TRXYx
TLSH
T154C25B72ECA4C9ABEDEA8BD5A74A7A07DEF0016399CC9AC0D5DC1D1C009B5AD030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b84d688d-7a66-4f40-8da1-f9e2468edcf2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b84d688d-7a66-4f40-8da1-f9e2468edcf2.tmp
Size 25KB
SHA256 d604679e5f4a1cee498bf7b4a52d3cc4e4e953bdff4e1c11fd3b30b746bfc555
MD5 2a86e19bb7f2b5a4e477d82e8debd40b
SHA1 2f85ed7d9576870c40608a1ab7be13006cc0d04c
SHA512 d84b473feda9639765bd50acf41231b17d9f0f007b379f222cc8256223f39d5bb8293563c0c988a6db0aabafedca94a102436c6e7ba887945757c25b692ddb24
SSDEEP 384:nxiFiZcIK3sN28TUNTUlI4MaKMiYKi2w2f0BCcD/1XSU1uDi0XHWgL/7IzfoQ:YFQK3nwgqUqjBCy/1isEi0XHU3
TLSH
T153C23A72ECA4DDA7ECEA8BD5A34A7A43DEF4016399DC9AC4D9DC5D1C00A719D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9f9ee18e98d1e6b907946f8077de37ab6bc2e02772fb5d635d4ddd0568c8e217
MD5 46a1c20757e5926c562de13de06ede93
SHA1 6fb430e7e5b6d96a941a9fb772cd315d28d6f97a
SHA512 e7307d89a74b9f968a51202917311741d5b7adcab421fc8754691f8f352f6bdba794855e27ace7a81a52a240e73d266dfbc5ad82f259b5f660464d5c1c7064ea
TLSH
T1B9412798A6F91158B3B36E56ABF6A96D887FB8372F07D45E10110E4F0A23A04C971737
MD5 SHA1 SHA512 TLSH

Submit Download

MSI902B.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI902B.tmp
Size 499KB
SHA256 f9b11c9b1a23990d13820ec8a43702b9a06a70bb31f1bbd36fff547f7d10c0e5
MD5 44d9dc3f779f15187db98bc0e82dbb22
SHA1 e22f0205f36a21231e5f80e911accf327d032038
SHA512 907158b3ce94389093900bc239395328c905e005a46818b1c93a4f0e5328c1d55a6032a2e4c57106f7c1c611b816031a469daffe5fe3e0c67d5d6ff2b287f3ae
SSDEEP 12288:2/xj7dMQBCZCywwvhLlHTlh2bnESXcGmEF/yE/AeA2u99:4j7CqCZCywwvhhHTlh2bnYG9/+2a
TLSH
T1B3B4BE67B7D4167AD98B913D84538112E7B3B401030482EF23A6C26D4EB3FD69B3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIa8733.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSIa8733.LOG
Size 104KB
SHA256 39aada5b3ecdbb23537688835496180536867b85570ff09027d803dc9880ebcc
MD5 619d7a39c5c548ff17d8919952c1f877
SHA1 bbaadf5cab1bc3dc3ee3cbdc7a9a0ff7af4efceb
SHA512 f4a1ba6314bed0abeddc68ad59265311795b4596eaecb0d27d110fd6c1396a9a2a2c415737caf7c29289be471dab8b517ca2522f380df97111b17ad07beac2c8
SSDEEP 1536:bn5PEycAXJDGjipkdFGwCEmo2x+cu4uku4uAWCEmo2x+cu4uku4ug2CEmo2x+cuy:xCMgJMmjgsBJ/BQ9wmfyoT
TLSH
T166A37A292FF41249B6FB66878FF784159A37F95C7936DA0D2482C10D0471E08ADAC7BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AtdtUSB.cat

Path C:\Users\Admin\AppData\Local\Temp\{7a663502-c51d-4d4d-a960-0972d57ac610}\AtdtUSB.cat
Size 11KB
SHA256 4017af0c23fc9aeefca4c6bf07fed19c2bedf1ae9d1c3798c5795df40f2e56f3
MD5 10ba1532feeb255c998bc6e664cd43f0
SHA1 190bd83419d70a3aa07d78e89b46f471fcc86d02
SHA512 ad34f3e34ad95e2c9cf5c531c114bea8523ab371430f5daac46903667be6a307590689780236bd63bd0c5a9382a592bed5902a8de102afe49b5d9f10126bf9f1
SSDEEP 192:CvfP4UrSybfJCMcPghXDEwXEhYCnn+8NunZMiuyCksX01k9z3A3EcNo7K:eHVfLyh3VNviCksR9zTcNIK
TLSH
T1A04219A696AC5182FD63ACA053E8F9433C3D23CB5900546522DEF7591D9B3C8F72826E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AtdtUSB.inf

Path C:\Users\Admin\AppData\Local\Temp\{7a663502-c51d-4d4d-a960-0972d57ac610}\AtdtUSB.inf
Size 1KB
SHA256 2412798e8570b11c23c107a489bbf745a06a011bcb6c5b08b56d53ba6c4e6199
MD5 dbc819c1882ac6468d99f7e36439e40c
SHA1 9a01578654a51da450c99cfc9d104046a014bcde
SHA512 1368954e4b599ba7b59766e6a06c7c42cfd8ee0ef85caf58d91276cbc59d0dabccb07f1250c1c86edf923eddc08cea879faa1bfbcaa030c61069e242cace9710
TLSH
T1A131CEB6124F0D6C596B174B2A47AAD3F384250028AA68C8BDCE80CDC7EC55D57285B6
MD5 SHA1 SHA512 TLSH

Submit Download

AtdtUSB.sys

Path C:\Users\Admin\AppData\Local\Temp\{7a663502-c51d-4d4d-a960-0972d57ac610}\AtdtUSB.sys
Size 195KB
SHA256 034c55c50d6d4b8b7ff61ca463d18982b5021d54885003a43cd60a53e041f9b7
MD5 95bca05b29ab0d31668d3d54d03492d0
SHA1 d4c00169dc31ddc23852a3f92436bc50d7681a0e
SHA512 ec425a97ee17972e7181d810a4a894ebf64263912b673dec60a251a13bdc6d91df8e1070347f441976818469060965d117678fbb15d65aaa75df65cf40c336f1
SSDEEP 3072:uhjbhWnUbnis3VUWyd/Q4Qol6zoCc0XmQEX8ur/0CZw5tWvi0UGhCX:+XVId/jl6HvPuzatOk
TLSH
T17C147CCB76583CD6C927847891D54A2AEBB2B8722B40D7DF07A4A3760E637C52F36314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AtdtUSBMon.cat

Path C:\Users\Admin\AppData\Local\Temp\{fda75576-849a-ac4b-a09e-adae33427fee}\AtdtUSBMon.cat
Size 11KB
SHA256 3dab50fee7493a35acceae5712d3f7e3207a81ef3b417b4c8dcb0197f574972e
MD5 5817700c4ccc1938b3aede3d3179b196
SHA1 906d0ffe59bf4a77d9023b63e103a7ae48ea7440
SHA512 38f8ad98420d024f7034282f8e01bd0a091ca8ad779bb635b52454207e1d371746f8acc53d637f6326e57b6f2a815a3d98d255bba348c8a06601c3aa21be33c2
SSDEEP 192:5REziquS3JCePghXDEwXEhYCr/8NunZMiuyCksX01k9z3A3EcHj12xp:5kiyh3rkNviCksR9zTcHh6p
TLSH
T1174209E2966C5083FD63ACA053ECE9937C3D23CB5900556A26DEF758095B3C8E71816D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AtdtUSBMon.inf

Path C:\Users\Admin\AppData\Local\Temp\{fda75576-849a-ac4b-a09e-adae33427fee}\AtdtUSBMon.inf
Size 1KB
SHA256 df0e2acb02d977c76087112d856c6e586c8999906ed3e6b67fa17fb03130513d
MD5 ab68139d6f498ebc838ba87625ddd6e1
SHA1 9fe896dfdb0ed9277fb44be66031d71998db0e99
SHA512 3048775e727f25a1048589710592c938f55b7ed47663890ca3a2dd3a7035ea2f5bbd136065cd086e01b1ee70ca1a1ec8de38a44f1f3f59a4f9e0bebef81f729a
TLSH
T17831A7B614020D7D35AB266726037B62F389300028A569CAF9CD48CFC7EC618C7685FE
MD5 SHA1 SHA512 TLSH

Submit Download

AtdtUSBMon.sys

Path C:\Users\Admin\AppData\Local\Temp\{fda75576-849a-ac4b-a09e-adae33427fee}\AtdtUSBMon.sys
Size 209KB
SHA256 4bd11500444abf7ba3e1b114cc6b6af7cff3977fc170d1881cd90e8cf2d862f5
MD5 0229d695726a903e2d84b27723493f28
SHA1 f8a76275ceb14ab54d2e9a697bc756bec7c58f9d
SHA512 88498d9c9a52402ea13632a7e2bf11f86a84f187f31d69069ae0c915dcbad663e0a99494b7c3052d5ec71d5aae413d89fef4a2c597b42cf28e5b3b0a9d3bb9d4
SSDEEP 3072:iplqgzP0EPVisEn0Z1TJjZxjS/cmCC0HrgOXHwCkc4sLtZw5OmA1wNTU:ippe0PN9FrPrLRIsehNTU
TLSH
T16E248C9B77A828D6D9279438C5D5462BEBB378322B5087DF07A493760E237C62F36314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem0.PNF

Path C:\Windows\INF\oem0.PNF
Size 5KB
SHA256 7a27404a6377496e82d2b7e2bf2b154064bf975affbe72fbc9a80fa424f500f6
MD5 fd093ac6c030c04baa30d3a05d0a3f71
SHA1 62b432dd176713cd23e7c8979a50fe93533066a4
SHA512 2d7630c009061e6b6456aa533a3b890afe01e80761de73d49ffb1a80e97c5ea994610ac206f8a687e1738191fb9d73a76a6c47824c3089e2e7b5a164a8ff15fc
SSDEEP 96:iUB4Aa5IjNAuLScz8Ui7cg06fXkRx1fsX+daDsu20:4IeuLSQ8Ui7cgZf0GXCkP7
TLSH
T10AB15A4573E98B15F0B68E742CF46AE66476BC526D12DB4F2250331C1C32F54DBB0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem1.PNF

Path C:\Windows\INF\oem1.PNF
Size 5KB
SHA256 a8b9185e1b94453b1c49c6172aa7096fabb3bcd2f77a61ccd9a552707c30816e
MD5 28f1befada362a762e017c9c336303d8
SHA1 585ccb8774b95c2e7f7b2a6dcf7a2763656a65fe
SHA512 32c32950960f07ed8f28159c2c6c234ac967a0f728453d03023082b557735b82acc51f643b467154e12985f2b9911f1ca242edd42092c3708f34b3bbb7a419c3
SSDEEP 96:Cwlh4C0VJTnNAw5nbbUD8F5DI6sXkRN1fsCY+M2sH:8TaWbbI8F5Dts0CCYwe
TLSH
T193B1675677EA8B01F1BA8E742DF4A6E75471BC026C11CB9F2250731D4C72E549BB0B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem2.PNF

Path C:\Windows\INF\oem2.PNF
Size 6KB
SHA256 3504bcd74e073a7f4755f500829fb541fb3ed42dfea9a6a76a7ace76e21af7f4
MD5 c956b1c6d8a2a21991b2cf08e2c0d9a2
SHA1 ca535462f4119b9f86d612ff97c5938d90cf5322
SHA512 7e8e12ff3cfdae5fef8c235bd67cf94f6edc1eb51ce972325d3751f15921a0b492e7286e453d813c423f0c8632a18be9e13b82e802f5598ac5d0571498bb74b0
SSDEEP 96:t4rgQY2e/NI0IXSu6o4zvM181fQ1UvZUuQSCUJ:p2e/BfosxZUK/
TLSH
T14ED13646B7F88B15F1BA9B306DB512E65436BC619C12C65F3160334E0D72E949AB0B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oem4.PNF

Path C:\Windows\INF\oem4.PNF
Size 7KB
SHA256 e8ccd0ddb7729318051f02c6e5e48486179458c52cf267cec9b4937302e44d2c
MD5 2c2ddc2a5069d6be1c9f0312a65518a4
SHA1 34b63d5ebbd3039d8421cc4697c6a0124469db64
SHA512 d64c79991129e252ac67a3867290e349ec4f86ac18f4998c7f1f693d08816bec6e222ba90fb27aa626a8b79ec92977c26f11f992d09e5cbbe71e17e81dfcea43
SSDEEP 96:LKJi47+0edYinxaWRUB3Jd1C36uGH5ivE4WIiIlY+Pn6ScCBTGxBQE3i:G204ZxdRUTNbo35lviOOBQES
TLSH
T11EF1264273D98A14F1B69EB49EF491E58426BCD25C02D72F3569730E3873ED4DBB022A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 b421fd3de513547e61855398c0221d9d09abbb0f97a15e8095c27d39e0a65640
MD5 584d86a96d06f302b492e10bb9eb3fcf
SHA1 bda083f2a2483cb4f44c3e823069b8dc89770f75
SHA512 ffad481332b3c3b4a144ec6b0ce6d914b6c39b365b2f6c7329f474863b44007011ea94fc23555a82d36c604df31135a5d7e9a57a27b5a1c15de1aa9137bf016b
SSDEEP 24576:0u8m+1zpdoO/vvTLL2WezWqCHvkTel2y6gGNUJX1O0K3+x/L4vlvuwdhz:y
TLSH
T11F47F42436F92210E7F39F3CA8F16A2B493A7D5B9C15DE8D05411F4E0921BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2333de16-2a2c-4228-838a-5c902dd85dda}_OnDiskSnapshotProp

Path \??\Volume{7d83d395-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2333de16-2a2c-4228-838a-5c902dd85dda}_OnDiskSnapshotProp
Size 6KB
SHA256 96a5959dc74d8eb9f3627f89246d929b06b12ae22556b26264f272a263c758bd
MD5 70cd0c4b978a8391322977e80ec2d896
SHA1 8c6df2776fa389ac6d80a23e10411ff4b804909d
SHA512 4fa2e784b8456343b0167b4aa0f93d25db0098a860f8e1003410ab1a143bc71eb886d592c46b77dc68445cd1a1a31888fd70776c5899d27c52a7f519ba91dc1b
SSDEEP 96:FdzTZfZ4y2kvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:LXZ9b++ZVmN
TLSH
T17CD1870C5AF54711E2B3AB7129F18557A477B811EF33CB8E0298238E6670A10F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download