Overview
overview
8Static
static
3HiroLaunch...t2.exe
windows11-21h2-x64
7HiroLaunch...t2.exe
windows11-ltsc_2024-x64
8$PLUGINSDI...dl.dll
windows11-21h2-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows11-21h2-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...er.bmp
windows11-21h2-x64
$PLUGINSDI...er.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...rd.bmp
windows11-21h2-x64
$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3Hiro Launcher.exe
windows11-21h2-x64
6Hiro Launcher.exe
windows11-ltsc_2024-x64
8uninstall.exe
windows11-21h2-x64
7uninstall.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...LL.dll
windows11-21h2-x64
3$PLUGINSDI...LL.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
8$PLUGINSDI...er.bmp
windows11-21h2-x64
$PLUGINSDI...er.bmp
windows11-ltsc_2024-x64
1Analysis
- max time kernel
899s - max time network
779s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 22:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HiroLauncher-0.4.24-Setup-test2.exe
Resource
win11-20260911-en
windows11-21h2-x64
12 signatures
900 seconds
Behavioral task
behavioral2
Sample
HiroLauncher-0.4.24-Setup-test2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
900 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11-20260911-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11-20260911-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260911-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20260911-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11-20260911-en
windows11-21h2-x64
2 signatures
900 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
900 seconds
Behavioral task
behavioral17
Sample
Hiro Launcher.exe
Resource
win11-20260911-en
windows11-21h2-x64
9 signatures
900 seconds
Behavioral task
behavioral18
Sample
Hiro Launcher.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
20 signatures
900 seconds
Behavioral task
behavioral19
Sample
uninstall.exe
Resource
win11-20260911-en
windows11-21h2-x64
6 signatures
900 seconds
Behavioral task
behavioral20
Sample
uninstall.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
900 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20260911-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260911-en
windows11-21h2-x64
3 signatures
900 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
900 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
General
- Target Hiro Launcher.exe
- Size 11.0MB
- Sample261102-166apsgd86
- SHA256 561b4116cab78a5c180b9c8ebd1b2159a6da9ad35bbb9117d189ad072b063da7
- MD5 2908223d9ffb8502fc8984cd046c3ae5
- SHA1 f946d1103b07ca87fc53fc474ce6f71c734fcfa3
- SHA512 913e09ce7afad53dd308e6092d25bc7be4b30b21684b6d5a91987a6a51629d48636d67a4a5cfc8cf6386ef767c2b5fa10ccce649fdd9f1d1e85b8b4e95f6c1d4
- SSDEEP 98304:WMlhRfPyJlikEnnFv/kvNJyNpQAfVXXkV6oe7HJ:nhRfF7LtnBJ
- TLSH T1F5C618213AAA99ADC59AC474C3464AB35E2230DB0B35B9FF449496383F79AF41F3C354
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Hiro Launcher.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1746052430\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-de-1996.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-el.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-it.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-ru.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_2077652430\male_names.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_2077652430\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1746052430\_platform_specific\win_x64\widevinecdm.dll.sig msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1697954956\LICENSE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1983155929\Mu\Advertising msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1707100693\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1983155929\Mu\Social msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-de-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1983155929\Mu\Cryptomining msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1983155929\Mu\LICENSE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1983155929\Mu\Staging msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1983155929\Sigma\Cryptomining msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-cu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_2077652430\model.markov msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1445438841\Microsoft.CognitiveServices.Speech.core.dll msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1445438841\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-bn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-fr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1983155929\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1868673164\ct_config.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_679924471\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-da.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-es.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-gu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-kn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-uk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1868673164\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_679924471\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-et.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-und-ethi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1983155929\Mu\Content msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1983155929\Sigma\Staging msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_2077652430\us_tv_and_film.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1254060279\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-cs.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-pa.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1868673164\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1131097064\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1697954956\adblock_snippet.js msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1697954956\Part-DE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1707100693\crl-set msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-be.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-eu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-sk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1983155929\Sigma\Analytics msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1254060279\metadata.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-ka.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-nb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1697954956\Part-ES msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1697954956\Part-IT msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1983155929\Mu\Other msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1983155929\Sigma\Entities msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1868673164\crs.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1131097064\protocols.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1131097064\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_2035792842\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-hu.hyb msedgewebview2.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Hiro Launcher.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Hiro Launcher.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 38 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{010481FE-F886-4D40-AECA-BCB123185E3B} explorer.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{753F3354-4715-40DE-9F80-7698B149FFE1} explorer.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4048 msedgewebview2.exe 4048 msedgewebview2.exe 712 explorer.exe 712 explorer.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1304 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe Token: SeShutdownPrivilege 712 explorer.exe Token: SeCreatePagefilePrivilege 712 explorer.exe - Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 4600 Hiro Launcher.exe 2348 sihost.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 4600 Hiro Launcher.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe - Suspicious use of SendNotifyMessage 42 IoCs
pid Process 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe 712 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2224 SearchHost.exe 4588 StartMenuExperienceHost.exe 712 explorer.exe - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 4600 wrote to memory of 1304 4600 Hiro Launcher.exe 89 PID 1304 wrote to memory of 2468 1304 msedgewebview2.exe 90 PID 1304 wrote to memory of 3588 1304 msedgewebview2.exe 91 PID 1304 wrote to memory of 3588 1304 msedgewebview2.exe 91 PID 1304 wrote to memory of 3588 1304 msedgewebview2.exe 91 PID 1304 wrote to memory of 3588 1304 msedgewebview2.exe 91 PID 1304 wrote to memory of 5036 1304 msedgewebview2.exe 92 PID 1304 wrote to memory of 5900 1304 msedgewebview2.exe 93 PID 1304 wrote to memory of 5900 1304 msedgewebview2.exe 93 PID 1304 wrote to memory of 5900 1304 msedgewebview2.exe 93 PID 1304 wrote to memory of 4108 1304 msedgewebview2.exe 94 PID 1304 wrote to memory of 4108 1304 msedgewebview2.exe 94 PID 1304 wrote to memory of 4108 1304 msedgewebview2.exe 94 PID 1304 wrote to memory of 4108 1304 msedgewebview2.exe 94 PID 1304 wrote to memory of 4108 1304 msedgewebview2.exe 94 PID 1304 wrote to memory of 3000 1304 msedgewebview2.exe 98 PID 1304 wrote to memory of 3000 1304 msedgewebview2.exe 98 PID 1304 wrote to memory of 3000 1304 msedgewebview2.exe 98 PID 1304 wrote to memory of 2352 1304 msedgewebview2.exe 99 PID 1304 wrote to memory of 2352 1304 msedgewebview2.exe 99 PID 1304 wrote to memory of 2352 1304 msedgewebview2.exe 99 PID 1304 wrote to memory of 4048 1304 msedgewebview2.exe 100 PID 1304 wrote to memory of 1248 1304 msedgewebview2.exe 101 PID 1304 wrote to memory of 1248 1304 msedgewebview2.exe 101 PID 1304 wrote to memory of 1248 1304 msedgewebview2.exe 101 PID 1304 wrote to memory of 1820 1304 msedgewebview2.exe 102 PID 1304 wrote to memory of 1820 1304 msedgewebview2.exe 102 PID 1304 wrote to memory of 1820 1304 msedgewebview2.exe 102 PID 1304 wrote to memory of 5792 1304 msedgewebview2.exe 103 PID 1304 wrote to memory of 5792 1304 msedgewebview2.exe 103 PID 1304 wrote to memory of 5792 1304 msedgewebview2.exe 103 PID 1304 wrote to memory of 2684 1304 msedgewebview2.exe 104 PID 1304 wrote to memory of 2684 1304 msedgewebview2.exe 104 PID 1304 wrote to memory of 2684 1304 msedgewebview2.exe 104 PID 1304 wrote to memory of 3592 1304 msedgewebview2.exe 105 PID 1304 wrote to memory of 3592 1304 msedgewebview2.exe 105 PID 1304 wrote to memory of 3592 1304 msedgewebview2.exe 105 PID 1304 wrote to memory of 4464 1304 msedgewebview2.exe 106 PID 1304 wrote to memory of 4464 1304 msedgewebview2.exe 106 PID 1304 wrote to memory of 4464 1304 msedgewebview2.exe 106 PID 1304 wrote to memory of 2556 1304 msedgewebview2.exe 108 PID 1304 wrote to memory of 2556 1304 msedgewebview2.exe 108 PID 1304 wrote to memory of 2556 1304 msedgewebview2.exe 108 PID 1304 wrote to memory of 5792 1304 msedgewebview2.exe 109 PID 1304 wrote to memory of 5792 1304 msedgewebview2.exe 109 PID 1304 wrote to memory of 5792 1304 msedgewebview2.exe 109 PID 2348 wrote to memory of 712 2348 sihost.exe 115 PID 1304 wrote to memory of 5692 1304 msedgewebview2.exe 122 PID 1304 wrote to memory of 5692 1304 msedgewebview2.exe 122 PID 1304 wrote to memory of 5692 1304 msedgewebview2.exe 122 PID 1304 wrote to memory of 3524 1304 msedgewebview2.exe 123 PID 1304 wrote to memory of 3524 1304 msedgewebview2.exe 123 PID 1304 wrote to memory of 3524 1304 msedgewebview2.exe 123 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hiro Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Hiro Launcher.exe"1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4600.4156.8813284948316112412 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView /prefetch:4 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd6b2b5fd8,0x7ffd6b2b5fe4,0x7ffd6b2b5ff03⤵PID:2468
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1800 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵PID:3588
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2160 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1948 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵PID:5900
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3344 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb /prefetch:13⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4472 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵PID:3000
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4456 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵PID:2352
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4564 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4048
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=840 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵PID:1248
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4464 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵PID:1820
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4600 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵PID:5792
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2672 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵PID:2684
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4460 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵PID:3592
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵PID:4464
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵PID:2556
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4660 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵PID:5792
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4676 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵PID:5692
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView" --webview-exe-name="Hiro Launcher.exe" --webview-exe-version=0.4.24 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4792 --field-trial-handle=1804,i,15576629456639358916,13310235104423972311,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:a20726e3cbf7be0b347e3517f38bc4dcb01e75eb3⤵PID:3524
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3240
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:712
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4588
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2224
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:4772
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 331f9163baf4a0a843f4873c0c0536f56cb217867b60911d1f2ed825655a4610
- MD5 e61c266674a1061011cc684fb87af4ae
- SHA1 9dd02ccdc261784a9312dcd7d6a97d824690b7d1
- SHA512 69024f3847c99ea657f861c06f433f72c21f603b42ae1bf2f52f3e189dcf7c75bfcd92569222a8103604a7a0bf9c11755742fac7fde4719991d267bdfe016388
- TLSH T1AED0122276860138D01030330596F5891500C51B400740406438852D1B940501A168A1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 650eeb1d33f320edc6f02995ca7d36e536ad86dbca08919af9ddff65c073e94c
- MD5 b24ecf87b4b50cdb7335d6e520cf4780
- SHA1 21bb1d3bac8d06f0003c4b8bae5d3a73f29cf176
- SHA512 79fcf882c78f0a94fd08cd5ab020f1bf3d5a1a7ddc5bc063f4bdafc0e3ef6ae972b03973d6ed49420020e235df0f5f77b28ae7126a3bf918107e61a36fe99c5a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\Default\1939f0e8-e7fa-4f09-827b-bb8bde745048.tmp
- Size 6KB
- SHA256 f54118326735154227ca3cd04809ae7bdc191f409dd2c5927c9be7d7f0c870af
- MD5 f59f2e27ad5b86885a0056496b73bf2b
- SHA1 15da17e8525e3b8cc8cc775069dd1a2924a0ca58
- SHA512 5161f2747d1eda5d4db67b61df85ee47e89ac47559ef847b2a3d38d1f0284bb199fbf25096d1146388246c80e70eaf29a5d625580878b187ce5e625c328c2309
- SSDEEP 96:stl/dr/+rM90b9Tkuno5h16ZPDs7/x+6Mhmuecpla1eje8K+ga28XM1C7K:stZl/p9KVno+DsV+FNlaQjsMG6K
- TLSH T18BD1A8116E2479BB4CC6E509BB29BA47E2F6603275D11E59EFFC852C04D7ACD230790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\Default\Code Cache\js\index-dir\temp-index
- Size 120B
- SHA256 41fc7af97c79c5b97eaa6cf628fb49fca7dd442ac2ed459a30b04b28a811b39d
- MD5 bedc94b010693529705fda8a9058449a
- SHA1 2d359ce102cb36f39e4625a199a1b6c0bb1baf4f
- SHA512 00de8049fd0821899338eec2991b8dc826948cd75d59f139b6db47a7c85817241efe5d942fb3cd487a9bf953e155b71ddba38e2d1e88827551d2c6c7d7a9fd97
- TLSH T1DBB0129100443371C3450E3015F5D17733FC0431D0030E06C34467315831F448205010
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\Default\Code Cache\wasm\index-dir\temp-index
- Size 48B
- SHA256 2bb88150e81d512dcf7c7ccfb8cd38f9155e4278999778eb5fb389bb4c184e3a
- MD5 e53741ddc592ccc4e1d2ed11bf4d4506
- SHA1 2cdaf4d54ae42a5e8bc4ca49a0f7330fe52dc2b9
- SHA512 e67c2654aa5159b6c7ac010e934319a91a288b5258e419e8f4df727417cb2a13dccb4b9f370ceaf05ff7b0249684fb5ba91853ba6a366932f1478fe60595d46b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\Default\Network\Network Persistent State
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\Default\Network\fef5df39-50b7-4111-8a19-0c0b677f6f2f.tmp
- Size 1KB
- SHA256 ce610a07b4ccd46ce1c7bcad2a6c768dd556b2e745ae99565ba628ac55a4b403
- MD5 3b55ad2ce63cc82bb24a9076c967e2de
- SHA1 c9497390f25110454dbe87c6ecd890035b594ce1
- SHA512 5039f9185dcb53a6b12bb2bd6bc655998c1fdbcc1c12e22b9a04f62a9ae24ab4eec357ffe31d8a1bc494fc97fb75a8ca09065d4bb3678f292b046d701a5dce92
- TLSH T1042149B682E48AAD895152F96624391BCF2D082D06BD3D2EC8E4EFCB57E1031D20464F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\Default\Preferences
- Size 6KB
- SHA256 33c76eba606b25bc036d90ec19e49e3b880ed2336548842f94ddc414b9ca433f
- MD5 315df46f43d89dad038fafa3c6cc4573
- SHA1 7eb6471fb6d72e3d273f888eabb394d53d2a580f
- SHA512 a7a3cd2824304426b8a9da83feadaad617b73919a565b5065b5758796efe2435b038226132c5949e3c6d895b110f71882035345fa7ec6dba826afd0dd66be7ac
- SSDEEP 96:stl/dr/+6GM90b9Tkuno5h16ZPDs7/x+6Mhmuecpla1eje8K+gA28XM1C7K:stZl/z9KVno+DsV+FNlaQjsuG6K
- TLSH T14CD1B8126E2479BB4CC6E118BB29BB47E2F6603265D11E59EFFC452C04DBADC230790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\GrShaderCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\GrShaderCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\GrShaderCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\GrShaderCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\Local State
- Size 1KB
- SHA256 c0ac48b4de2e5c271c522f10f7744dfec8abea32bf0822138bfcb9d27dbcc868
- MD5 b17782acfd4530054ec585d7e5cd2b36
- SHA1 23c99c4ec993d24a488bd62330016d8f477b0436
- SHA512 fb0a4731751086a530b087b1499baf47bc64fc3ca48c5757ed35c139e7b4f49fefb440b67c60e0f422859be51dd1cfe9887117d1e7308008257c91708b8eed1d
- TLSH T116217271F474AB32ACD1A56523567BA74E212062C3614E00AACF4B1C01B384D569683B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\b1f99758-f42e-403a-9536-c87e5bc77b44.tmp
- Size 15KB
- SHA256 c948852f72c892a445f71902d9e9a9db6e416f37cca52cfe567d1fb1ce520b41
- MD5 94825d2cdcbe6cfcf2b6bd48404c751a
- SHA1 c4de68657d7561aeeaa69a7fb8eb9902011773d0
- SHA512 4ab431fbe14e69e8cd903640f177ee976cf5c0470a62b7d3a8f439c5fd19be48f31905f226c0296dc9ad76c97e0981a99fb135b8892cc12774aa4bc304d9c9a3
- SSDEEP 384:u+OBqImmJvGBLx3NaFMJFANBSmAOVmHg6rU:rcvGtlNm0VQ
- TLSH T18F72AD3628756E772CF789097B8A2387CB616293C0D17BE9DEED8F0E116F8841392915
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\c9d47c95-df62-4043-ae28-c616e2fa271f.tmp
- Size 3KB
- SHA256 3811d355afca313d715b13180861184c549c392e8c0b64ac10cc0454543ade57
- MD5 b2a722873dc9d5cc17d4f3748c2692c5
- SHA1 d28201512a875ba39794ad0584edbad37a655a28
- SHA512 dcc15a0648d287934df5e080826416fe69b7cc4cc46a50b37e8ba5537f0849e13d5d46a4c74441e9526f1c6cf24bf2339fb66e6337b064320c9ad83448268437
- TLSH T1DF61B632B974A93B4DF2DA147A863B16A7A15023E6D13F95DEEE0F0C01E76881381C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.hiro.launcher\EBWebView\de764636-906c-4874-b7ea-8b77fb846b4b.tmp
- Size 2KB
- SHA256 7932495fadc0ad6409c9884f26d9da17196934b387e132764b9b44397d4cd038
- MD5 4b209c617d195383e781fb5dd6195132
- SHA1 7f177160c8323633727ee49408df7922621a1765
- SHA512 85ba0479cf28b89a9880e54ea227285688bbd4cfd848acca419ec26feb36b2c69f456eba079f8f7bc541e212f58d161d4c3e39911c1026eabb8f5e021fa300ab
- TLSH T1D751A732B824A67799E28A147E5A3B63CA3560A19B621F11DFDF0B0C00E795D1381C3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1131097064\manifest.json
- Size 135B
- SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
- MD5 616eb6b585f16811dc5db5063e088cd7
- SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
- SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
- TLSH T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1254060279\manifest.json
- Size 108B
- SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
- MD5 8e9357dbfee2ec0378af047a76d0b453
- SHA1 794f8cce8fbea87b2b62162769bee35c319ebfa0
- SHA512 85b5f52013803198e6af0ba37c9c3c66ce4bed4df5a7ee86ca1fc7c3658e2c973e92eed88fd36864d4743db44ad81fda7b24e70ef7530212e85b12c13d5db29d
- TLSH T1E2B012A13C007DBB1DCD03760060E3D783B63E0A1659190006DB6D422A4C9FB137253F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1445438841\manifest.json
- Size 76B
- SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
- MD5 ba25fcf816a017558d3434583e9746b8
- SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
- SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
- TLSH T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1697954956\manifest.json
- Size 116B
- SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
- MD5 daf93729356a67ea1f849554827fdab1
- SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
- SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
- TLSH T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1707100693\manifest.json
- Size 118B
- SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
- MD5 acb0c12cc7e5345764763e37bcebbec8
- SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
- SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
- TLSH T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1746052430\manifest.json
- Size 1005B
- SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
- MD5 58954048e70c81669675d4f87ab50af1
- SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
- SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
- TLSH T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1868673164\manifest.json
- Size 102B
- SHA256 0ed889bea99f74fede865222f4cacca4277c63023db98efa666d42ba1f7f9502
- MD5 329ad25b265a82c711c72c02a553a353
- SHA1 a9a666d4182caad82edd399fdab141473670c5a7
- SHA512 b81005847e76dc513b255b36704dec0ae84c922d23dc152cc42bb3eec9e18cb083e601bb90562b3f3c9b2ac540e801866f59277b9c43c0b97fd3e90b688f26c5
- TLSH T178B01220EC10B4B3000403AC0C6CC3C063372F032C4079180DE59F84E80D9DBE071E29
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1983155929\Sigma\Other
- Size 34B
- SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
- MD5 cd0395742b85e2b669eaec1d5f15b65b
- SHA1 43c81d1c62fc7ff94f9364639c9a46a0747d122e
- SHA512 4df2ce734e2f7bc5f02bb7845ea801b57dcf649565dd94b1b71f578b453ba0a17c61ccee73e7cff8f23cdd6aa37e55be5cb15f4767ff88a9a06de3623604fbf0
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1983155929\manifest.json
- Size 132B
- SHA256 de864bf0ab8abacfba536d4e9764eca658f903bd2457f955e128c4ee181c7e58
- MD5 c9209ab189a035569ba3c65d7375d220
- SHA1 1987aaec8f436325415fe36c168c9a37829523f9
- SHA512 60495e096f78de05c6025a9d7b69aef9dce0d08ec1abbd4ccba206827a8c25d8449f54f93637599649762ec09a034d32fc8afc06199b1b57cd010ff1a0c850c0
- TLSH T17FC092615802797A14DEB7F00D29CB926AB3CB2E18A4650546F5C228ED2DCDFB5B330B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_2035792842\manifest.json
- Size 43B
- SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
- MD5 af3a9104ca46f35bb5f6123d89c25966
- SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
- SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
- MD5 SHA1 SHA512
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_2077652430\manifest.json
- Size 69B
- SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
- MD5 fb0d9796a86299d3689982f7a949dc6e
- SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
- SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
- TLSH T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_679924471\manifest.json
- Size 80B
- SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
- MD5 3790d9257ba14f8be2ba08acf259a57f
- SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
- SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
- TLSH T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-as.hyb
- Size 703B
- SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
- MD5 8961fdd3db036dd43002659a4e4a7365
- SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
- SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
- TLSH T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-hi.hyb
- Size 687B
- SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
- MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
- SHA1 d0914fb069469d47a36d339ca70164253fccf022
- SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
- TLSH T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\hyph-nb.hyb
- Size 141KB
- SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
- MD5 677edd1a17d50f0bd11783f58725d0e7
- SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
- SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
- SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
- TLSH T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_758473343\manifest.json
- Size 82B
- SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
- MD5 2617c38bed67a4190fc499142b6f2867
- SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
- SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
- TLSH T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
- MD5 SHA1 SHA512 TLSH