amadey | ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5

Analysis

max time kernel
300s
max time network
299s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
27-06-2024 23:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe
Size

1.8MB
MD5

64271b0d8929719937cf9537b61e03e8
SHA1

b72eab115956c43195693f4657dceee61575a1b1
SHA256

ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5
SHA512

b6fa3767d468820617d658a199a9bca83fda7e5e7efc73d6816723c6bbb905cbe280a7d2fbe242e1c1f4d36d6cdd078920bd9821b33cc521e2755e20a323a099
SSDEEP

49152:N5x1GDhKR3frA51OzyL/S3Mj+PlYxnNILRohj84iNT:3x1GER3friO2LaMXxn/Bi

Score

10^/10

amadey monster redline 06-25-24 123 @logscloudyt_bot e76b71 discovery evasion execution infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

http://77.91.77.81

Attributes

install_dir
8254624243
install_file
axplong.exe
strings_key
90049e51fabf09df0d6748e0b271922e
url_paths
/Kiru9gu/index.php

rc4.plain

Extracted

Family

redline

Botnet

123

185.215.113.67:40960

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

185.172.128.33:8970

Extracted

Family

redline

Botnet

06-25-24

85.28.47.7:17210

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Detects Monster Stealer. 1 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\onefile_2400_133640051299857577\stub.exe family_monster
Monster
Monster is a Golang stealer that was discovered in 2024.
stealer monster
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\onefile_2400_133640051299857577\stub.exe	family_monster

RedLine payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000110001\123.exe	family_redline
behavioral2/memory/2764-73-0x00000000000F0000-0x0000000000140000-memory.dmp	family_redline
behavioral2/memory/1336-632-0x0000000000FC0000-0x0000000001012000-memory.dmp	family_redline
behavioral2/memory/344-674-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exeaxplong.exeaxplong.exeaxplong.exeaxplong.exe7.exeaxplong.exeaxplong.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

3300 powershell.exe
2376 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

pid	process
3300	powershell.exe
2376	powershell.exe

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

axplong.exeaxplong.exe7.exeaxplong.exeaxplong.exeff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exeaxplong.exeaxplong.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

123.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\International\Geo\Nation 123.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\International\Geo\Nation	123.exe

Executes dropped EXE 26 IoCs

Processes:

axplong.exeaxplong.exeaxplong.exeNewLatest.exeHkbsse.exe123.exeHkbsse.exeaxplong.exe1.exeFirstZ.exestreamer.exeTpWWMUpe0LEV.exe6.exe7.exereakuqnanrkn.exebuild.exestub.exeFILE1.exesvhoosts.exeexplorers.exestl.exeHkbsse.exeaxplong.exestl.exeHkbsse.exeaxplong.exe

pid	process
4712	axplong.exe
2872	axplong.exe
3396	axplong.exe
512	NewLatest.exe
356	Hkbsse.exe
2764	123.exe
4652	Hkbsse.exe
3572	axplong.exe
2704	1.exe
2188	FirstZ.exe
1280	streamer.exe
3628	TpWWMUpe0LEV.exe
4896	6.exe
4436	7.exe
3392	reakuqnanrkn.exe
2400	build.exe
2168	stub.exe
3692	FILE1.exe
1336	svhoosts.exe
4112	explorers.exe
2216	stl.exe
4356	Hkbsse.exe
4248	axplong.exe
344	stl.exe
5284	Hkbsse.exe
5316	axplong.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

axplong.exeaxplong.exeff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exeaxplong.exeaxplong.exeaxplong.exeaxplong.exe7.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Wine	7.exe

Loads dropped DLL 33 IoCs

Processes:

TpWWMUpe0LEV.exestub.exe

pid	process
3628	TpWWMUpe0LEV.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe
2168	stub.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service
T1102

Processes:

flow ioc

25 bitbucket.org
73 bitbucket.org
86 pastebin.com
87 pastebin.com
24 bitbucket.org
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

4320 powercfg.exe
1480 powercfg.exe
4876 powercfg.exe
3960 powercfg.exe
4708 powercfg.exe
1856 powercfg.exe
4800 powercfg.exe
3556 powercfg.exe

flow	ioc
25	bitbucket.org
73	bitbucket.org
86	pastebin.com
87	pastebin.com
24	bitbucket.org

pid	process
4320	powercfg.exe
1480	powercfg.exe
4876	powercfg.exe
3960	powercfg.exe
4708	powercfg.exe
1856	powercfg.exe
4800	powercfg.exe
3556	powercfg.exe

Drops file in System32 directory 4 IoCs

Processes:

FirstZ.exepowershell.exereakuqnanrkn.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	FirstZ.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	reakuqnanrkn.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exeaxplong.exeaxplong.exeaxplong.exeaxplong.exe7.exeaxplong.exeaxplong.exe

pid process

1452 ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe
4712 axplong.exe
2872 axplong.exe
3396 axplong.exe
3572 axplong.exe
4436 7.exe
4248 axplong.exe
5316 axplong.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

TpWWMUpe0LEV.exereakuqnanrkn.exestreamer.exeFILE1.exestl.exe

description	pid	process	target process
PID 3628 set thread context of 4752	3628	TpWWMUpe0LEV.exe	aspnet_regiis.exe
PID 3392 set thread context of 348	3392	reakuqnanrkn.exe	conhost.exe
PID 3392 set thread context of 4468	3392	reakuqnanrkn.exe	explorer.exe
PID 1280 set thread context of 2188	1280	streamer.exe	BitLockerToGo.exe
PID 3692 set thread context of 4524	3692	FILE1.exe	RegAsm.exe
PID 2216 set thread context of 344	2216	stl.exe	stl.exe

Drops file in Windows directory 6 IoCs

Processes:

MicrosoftEdgeCP.exeff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exeNewLatest.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\Tasks\axplong.job	ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe
File created	C:\Windows\Tasks\Hkbsse.job	NewLatest.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe

Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

240 sc.exe
1100 sc.exe
1016 sc.exe
2504 sc.exe
2584 sc.exe
1100 sc.exe
3776 sc.exe
408 sc.exe
4684 sc.exe
4828 sc.exe
992 sc.exe
3784 sc.exe
2896 sc.exe
2148 sc.exe
Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\cryptography\hazmat\bindings\_rust.pyd embeds_openssl
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

1672 2704 WerFault.exe 1.exe
908 3692 WerFault.exe FILE1.exe
4316 4752 WerFault.exe aspnet_regiis.exe

pid	process
240	sc.exe
1100	sc.exe
1016	sc.exe
2504	sc.exe
2584	sc.exe
1100	sc.exe
3776	sc.exe
408	sc.exe
4684	sc.exe
4828	sc.exe
992	sc.exe
3784	sc.exe
2896	sc.exe
2148	sc.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\cryptography\hazmat\bindings\_rust.pyd	embeds_openssl

pid	pid_target	process	target process
1672	2704	WerFault.exe	1.exe
908	3692	WerFault.exe	FILE1.exe
4316	4752	WerFault.exe	aspnet_regiis.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

aspnet_regiis.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	aspnet_regiis.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

4384 tasklist.exe

pid	process
4384	tasklist.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

browser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Telligent	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "425693613"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000bf89e94f87bd3db629fe567c30a839a13766b6652bf8c17444de4910f0572209e766f80b0cc6470c9704153ea2599bdd96eb6b3a5f477a9d1e01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "426372677"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 64fcb11aebc8da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 80d1b32debc8da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 506d633febc8da01	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = e0b0e2821dc9da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a0ec7f1aebc8da01	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

svhoosts.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	svhoosts.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	svhoosts.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exeaxplong.exeaxplong.exeaxplong.exeaxplong.exe123.exe6.exe7.exeFirstZ.exepowershell.exereakuqnanrkn.exepowershell.exeexplorer.exe

pid	process
1452	ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe
1452	ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe
4712	axplong.exe
4712	axplong.exe
2872	axplong.exe
2872	axplong.exe
3396	axplong.exe
3396	axplong.exe
3572	axplong.exe
3572	axplong.exe
2764	123.exe
2764	123.exe
2764	123.exe
4896	6.exe
4896	6.exe
4436	7.exe
4436	7.exe
2188	FirstZ.exe
3300	powershell.exe
3300	powershell.exe
3300	powershell.exe
3300	powershell.exe
2188	FirstZ.exe
2188	FirstZ.exe
2188	FirstZ.exe
2188	FirstZ.exe
2188	FirstZ.exe
2188	FirstZ.exe
2188	FirstZ.exe
2188	FirstZ.exe
2188	FirstZ.exe
2188	FirstZ.exe
2188	FirstZ.exe
2188	FirstZ.exe
2188	FirstZ.exe
2188	FirstZ.exe
3392	reakuqnanrkn.exe
2376	powershell.exe
2376	powershell.exe
2376	powershell.exe
2376	powershell.exe
3392	reakuqnanrkn.exe
3392	reakuqnanrkn.exe
3392	reakuqnanrkn.exe
3392	reakuqnanrkn.exe
3392	reakuqnanrkn.exe
3392	reakuqnanrkn.exe
3392	reakuqnanrkn.exe
3392	reakuqnanrkn.exe
3392	reakuqnanrkn.exe
3392	reakuqnanrkn.exe
3392	reakuqnanrkn.exe
3392	reakuqnanrkn.exe
4468	explorer.exe
4468	explorer.exe
4468	explorer.exe
4468	explorer.exe
4468	explorer.exe
4468	explorer.exe
4468	explorer.exe
4468	explorer.exe
4468	explorer.exe
4468	explorer.exe
4468	explorer.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

2864 MicrosoftEdgeCP.exe
2864 MicrosoftEdgeCP.exe
2864 MicrosoftEdgeCP.exe

pid	process
2864	MicrosoftEdgeCP.exe
2864	MicrosoftEdgeCP.exe
2864	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

123.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exeexplorer.exepowercfg.exepowercfg.exetasklist.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2764	123.exe
Token: SeDebugPrivilege	804	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	804	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	804	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	804	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3132	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3132	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeIncreaseQuotaPrivilege	3300	powershell.exe
Token: SeSecurityPrivilege	3300	powershell.exe
Token: SeTakeOwnershipPrivilege	3300	powershell.exe
Token: SeLoadDriverPrivilege	3300	powershell.exe
Token: SeSystemProfilePrivilege	3300	powershell.exe
Token: SeSystemtimePrivilege	3300	powershell.exe
Token: SeProfSingleProcessPrivilege	3300	powershell.exe
Token: SeIncBasePriorityPrivilege	3300	powershell.exe
Token: SeCreatePagefilePrivilege	3300	powershell.exe
Token: SeBackupPrivilege	3300	powershell.exe
Token: SeRestorePrivilege	3300	powershell.exe
Token: SeShutdownPrivilege	3300	powershell.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeSystemEnvironmentPrivilege	3300	powershell.exe
Token: SeRemoteShutdownPrivilege	3300	powershell.exe
Token: SeUndockPrivilege	3300	powershell.exe
Token: SeManageVolumePrivilege	3300	powershell.exe
Token: 33	3300	powershell.exe
Token: 34	3300	powershell.exe
Token: 35	3300	powershell.exe
Token: 36	3300	powershell.exe
Token: SeShutdownPrivilege	1480	powercfg.exe
Token: SeCreatePagefilePrivilege	1480	powercfg.exe
Token: SeShutdownPrivilege	3556	powercfg.exe
Token: SeCreatePagefilePrivilege	3556	powercfg.exe
Token: SeShutdownPrivilege	4876	powercfg.exe
Token: SeCreatePagefilePrivilege	4876	powercfg.exe
Token: SeShutdownPrivilege	4320	powercfg.exe
Token: SeCreatePagefilePrivilege	4320	powercfg.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2376	powershell.exe
Token: SeIncreaseQuotaPrivilege	2376	powershell.exe
Token: SeSecurityPrivilege	2376	powershell.exe
Token: SeTakeOwnershipPrivilege	2376	powershell.exe
Token: SeLoadDriverPrivilege	2376	powershell.exe
Token: SeSystemtimePrivilege	2376	powershell.exe
Token: SeBackupPrivilege	2376	powershell.exe
Token: SeRestorePrivilege	2376	powershell.exe
Token: SeShutdownPrivilege	2376	powershell.exe
Token: SeSystemEnvironmentPrivilege	2376	powershell.exe
Token: SeUndockPrivilege	2376	powershell.exe
Token: SeManageVolumePrivilege	2376	powershell.exe
Token: SeShutdownPrivilege	3960	powercfg.exe
Token: SeCreatePagefilePrivilege	3960	powercfg.exe
Token: SeShutdownPrivilege	4708	powercfg.exe
Token: SeLockMemoryPrivilege	4468	explorer.exe
Token: SeCreatePagefilePrivilege	4708	powercfg.exe
Token: SeShutdownPrivilege	4800	powercfg.exe
Token: SeCreatePagefilePrivilege	4800	powercfg.exe
Token: SeShutdownPrivilege	1856	powercfg.exe
Token: SeCreatePagefilePrivilege	1856	powercfg.exe
Token: SeDebugPrivilege	4384	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4176	WMIC.exe
Token: SeSecurityPrivilege	4176	WMIC.exe
Token: SeTakeOwnershipPrivilege	4176	WMIC.exe
Token: SeLoadDriverPrivilege	4176	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe

pid process

1452 ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

pid process

3328 MicrosoftEdge.exe
2864 MicrosoftEdgeCP.exe
804 MicrosoftEdgeCP.exe
2864 MicrosoftEdgeCP.exe

pid	process
3328	MicrosoftEdge.exe
2864	MicrosoftEdgeCP.exe
804	MicrosoftEdgeCP.exe
2864	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exeaxplong.exeNewLatest.exeHkbsse.exeMicrosoftEdgeCP.exeTpWWMUpe0LEV.exe123.execmd.execmd.exereakuqnanrkn.exestreamer.exe

description	pid	process	target process
PID 1452 wrote to memory of 4712	1452	ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe	axplong.exe
PID 1452 wrote to memory of 4712	1452	ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe	axplong.exe
PID 1452 wrote to memory of 4712	1452	ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe	axplong.exe
PID 4712 wrote to memory of 512	4712	axplong.exe	NewLatest.exe
PID 4712 wrote to memory of 512	4712	axplong.exe	NewLatest.exe
PID 4712 wrote to memory of 512	4712	axplong.exe	NewLatest.exe
PID 512 wrote to memory of 356	512	NewLatest.exe	Hkbsse.exe
PID 512 wrote to memory of 356	512	NewLatest.exe	Hkbsse.exe
PID 512 wrote to memory of 356	512	NewLatest.exe	Hkbsse.exe
PID 4712 wrote to memory of 2764	4712	axplong.exe	123.exe
PID 4712 wrote to memory of 2764	4712	axplong.exe	123.exe
PID 4712 wrote to memory of 2764	4712	axplong.exe	123.exe
PID 356 wrote to memory of 2704	356	Hkbsse.exe	1.exe
PID 356 wrote to memory of 2704	356	Hkbsse.exe	1.exe
PID 356 wrote to memory of 2704	356	Hkbsse.exe	1.exe
PID 356 wrote to memory of 2188	356	Hkbsse.exe	FirstZ.exe
PID 356 wrote to memory of 2188	356	Hkbsse.exe	FirstZ.exe
PID 4712 wrote to memory of 1280	4712	axplong.exe	streamer.exe
PID 4712 wrote to memory of 1280	4712	axplong.exe	streamer.exe
PID 2864 wrote to memory of 2636	2864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2864 wrote to memory of 2636	2864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2864 wrote to memory of 2636	2864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2864 wrote to memory of 2636	2864	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 4712 wrote to memory of 3628	4712	axplong.exe	TpWWMUpe0LEV.exe
PID 4712 wrote to memory of 3628	4712	axplong.exe	TpWWMUpe0LEV.exe
PID 4712 wrote to memory of 3628	4712	axplong.exe	TpWWMUpe0LEV.exe
PID 3628 wrote to memory of 4752	3628	TpWWMUpe0LEV.exe	aspnet_regiis.exe
PID 3628 wrote to memory of 4752	3628	TpWWMUpe0LEV.exe	aspnet_regiis.exe
PID 3628 wrote to memory of 4752	3628	TpWWMUpe0LEV.exe	aspnet_regiis.exe
PID 3628 wrote to memory of 4752	3628	TpWWMUpe0LEV.exe	aspnet_regiis.exe
PID 3628 wrote to memory of 4752	3628	TpWWMUpe0LEV.exe	aspnet_regiis.exe
PID 3628 wrote to memory of 4752	3628	TpWWMUpe0LEV.exe	aspnet_regiis.exe
PID 3628 wrote to memory of 4752	3628	TpWWMUpe0LEV.exe	aspnet_regiis.exe
PID 3628 wrote to memory of 4752	3628	TpWWMUpe0LEV.exe	aspnet_regiis.exe
PID 3628 wrote to memory of 4752	3628	TpWWMUpe0LEV.exe	aspnet_regiis.exe
PID 2764 wrote to memory of 4896	2764	123.exe	6.exe
PID 2764 wrote to memory of 4896	2764	123.exe	6.exe
PID 2764 wrote to memory of 4896	2764	123.exe	6.exe
PID 2764 wrote to memory of 4436	2764	123.exe	7.exe
PID 2764 wrote to memory of 4436	2764	123.exe	7.exe
PID 2764 wrote to memory of 4436	2764	123.exe	7.exe
PID 908 wrote to memory of 3088	908	cmd.exe	wusa.exe
PID 908 wrote to memory of 3088	908	cmd.exe	wusa.exe
PID 4168 wrote to memory of 3556	4168	cmd.exe	wusa.exe
PID 4168 wrote to memory of 3556	4168	cmd.exe	wusa.exe
PID 3392 wrote to memory of 348	3392	reakuqnanrkn.exe	conhost.exe
PID 3392 wrote to memory of 348	3392	reakuqnanrkn.exe	conhost.exe
PID 3392 wrote to memory of 348	3392	reakuqnanrkn.exe	conhost.exe
PID 3392 wrote to memory of 348	3392	reakuqnanrkn.exe	conhost.exe
PID 3392 wrote to memory of 348	3392	reakuqnanrkn.exe	conhost.exe
PID 3392 wrote to memory of 348	3392	reakuqnanrkn.exe	conhost.exe
PID 3392 wrote to memory of 348	3392	reakuqnanrkn.exe	conhost.exe
PID 3392 wrote to memory of 348	3392	reakuqnanrkn.exe	conhost.exe
PID 3392 wrote to memory of 348	3392	reakuqnanrkn.exe	conhost.exe
PID 3392 wrote to memory of 4468	3392	reakuqnanrkn.exe	explorer.exe
PID 3392 wrote to memory of 4468	3392	reakuqnanrkn.exe	explorer.exe
PID 3392 wrote to memory of 4468	3392	reakuqnanrkn.exe	explorer.exe
PID 3392 wrote to memory of 4468	3392	reakuqnanrkn.exe	explorer.exe
PID 3392 wrote to memory of 4468	3392	reakuqnanrkn.exe	explorer.exe
PID 1280 wrote to memory of 2188	1280	streamer.exe	BitLockerToGo.exe
PID 1280 wrote to memory of 2188	1280	streamer.exe	BitLockerToGo.exe
PID 1280 wrote to memory of 2188	1280	streamer.exe	BitLockerToGo.exe
PID 1280 wrote to memory of 2188	1280	streamer.exe	BitLockerToGo.exe
PID 1280 wrote to memory of 2188	1280	streamer.exe	BitLockerToGo.exe

C:\Users\Admin\AppData\Local\Temp\ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe
"C:\Users\Admin\AppData\Local\Temp\ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1452

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
"C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4712

C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
"C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"
3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:512

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
"C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:356

C:\Users\Admin\AppData\Local\Temp\1000020001\1.exe
"C:\Users\Admin\AppData\Local\Temp\1000020001\1.exe"
5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 500
6⤵
- Program crash
PID:1672

C:\Users\Admin\AppData\Local\Temp\1000023001\FirstZ.exe
"C:\Users\Admin\AppData\Local\Temp\1000023001\FirstZ.exe"
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2188

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
6⤵
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
7⤵
PID:3088

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
6⤵
- Launches sc.exe
PID:408

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
6⤵
- Launches sc.exe
PID:3784

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
6⤵
- Launches sc.exe
PID:2896

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
6⤵
- Launches sc.exe
PID:4684

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
6⤵
- Launches sc.exe
PID:1100

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
6⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
6⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
6⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
6⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "WSNKISKT"
6⤵
- Launches sc.exe
PID:1016

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
6⤵
- Launches sc.exe
PID:2148

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
6⤵
- Launches sc.exe
PID:2504

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WSNKISKT"
6⤵
- Launches sc.exe
PID:2584

C:\Users\Admin\AppData\Local\Temp\1000110001\123.exe
"C:\Users\Admin\AppData\Local\Temp\1000110001\123.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764

C:\Users\Admin\AppData\Local\Temp\6.exe
"C:\Users\Admin\AppData\Local\Temp\6.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4896

C:\Users\Admin\AppData\Local\Temp\7.exe
"C:\Users\Admin\AppData\Local\Temp\7.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4436

C:\Users\Admin\AppData\Local\Temp\1000111001\streamer.exe
"C:\Users\Admin\AppData\Local\Temp\1000111001\streamer.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
4⤵
PID:2188

C:\Users\Admin\AppData\Local\Temp\1000112001\TpWWMUpe0LEV.exe
"C:\Users\Admin\AppData\Local\Temp\1000112001\TpWWMUpe0LEV.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
4⤵
- Checks processor information in registry
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1092
5⤵
- Program crash
PID:4316

C:\Users\Admin\AppData\Local\Temp\1000115001\build.exe
"C:\Users\Admin\AppData\Local\Temp\1000115001\build.exe"
3⤵
- Executes dropped EXE
PID:2400

C:\Users\Admin\AppData\Local\Temp\onefile_2400_133640051299857577\stub.exe
"C:\Users\Admin\AppData\Local\Temp\1000115001\build.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
5⤵
PID:1060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
5⤵
PID:2940

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist"
5⤵
PID:3360

C:\Windows\system32\tasklist.exe
tasklist
6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Users\Admin\AppData\Local\Temp\1000116001\FILE1.exe
"C:\Users\Admin\AppData\Local\Temp\1000116001\FILE1.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
PID:4524

C:\Users\Admin\AppData\Roaming\configurationValue\svhoosts.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\svhoosts.exe"
5⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1336

C:\Users\Admin\AppData\Roaming\configurationValue\explorers.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\explorers.exe"
5⤵
- Executes dropped EXE
PID:4112

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
5⤵
PID:5884

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
6⤵
PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 320
4⤵
- Program crash
PID:908

C:\Users\Admin\AppData\Local\Temp\1000118001\stl.exe
"C:\Users\Admin\AppData\Local\Temp\1000118001\stl.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2216

C:\Users\Admin\AppData\Local\Temp\1000118001\stl.exe
C:\Users\Admin\AppData\Local\Temp\1000118001\stl.exe
4⤵
- Executes dropped EXE
PID:344

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2872

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3396

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:4652

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3572

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3328

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4792

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:804

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2636

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3392

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
- Suspicious use of WriteProcessMemory
PID:4168

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:3556

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:1100

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:992

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:3776

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:4828

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
- Launches sc.exe
PID:240

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3960

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1856

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:348

C:\Windows\explorer.exe
explorer.exe
2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:4356

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4248

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5224

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:5528

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5636

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:5872

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:5952

C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:5284

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T28YHK6H\edgecompatviewlist[1].xml
Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\8L81Y5DZ\favicon[1].png
Filesize
2KB

MD5
18c023bc439b446f91bf942270882422

SHA1
768d59e3085976dba252232a65a4af562675f782

SHA256
e0e71acef1efbfab69a1a60cd8fadded948d0e47a0a27c59a0be7033f6a84482

SHA512
a95ad7b48596bc0af23d05d1e58681e5d65e707247f96c5bc088880f4525312a1834a89615a0e33aea6b066793088a193ec29b5c96ea216f531c443487ae0735

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\QP6ZO89V\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000020001\1.exe
Filesize
317KB

MD5
e1b59d2805b38262b9967bce3e719dbf

SHA1
4081416cfaa76941981c34518d45b60e8d4b2013

SHA256
d5bba713d11ebbb7a91be59dae0f2d4b818897fe756b854dfe40babe7664c173

SHA512
bcea30a8f2a10aed0e2c97133734a34a850c18ee9447966ed8cdae8bbf72b98ebd2703a7cadf53b8991ef5eb3047d871242e990a4b7baf00eda8ca5f5f7dda35

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000023001\FirstZ.exe
Filesize
2.5MB

MD5
ffada57f998ed6a72b6ba2f072d2690a

SHA1
6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

SHA256
677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

SHA512
1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
Filesize
415KB

MD5
07101cac5b9477ba636cd8ca7b9932cb

SHA1
59ea7fd9ae6ded8c1b7240a4bf9399b4eb3849f1

SHA256
488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77

SHA512
02240ff51a74966bc31cfcc901105096eb871f588efaa9be1a829b4ee6f245bd9dca37be7e2946ba6315feea75c3dce5f490847250e62081445cd25b0f406887

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000110001\123.exe
Filesize
297KB

MD5
cd581d68ed550455444ee6e099c44266

SHA1
f131d587578336651fd3e325b82b6c185a4b6429

SHA256
a2ebb4bbf2ae4f7755b3ab604996e6c7e570ac8837ca544854ed696a81972505

SHA512
33f94920032436cd45906c27cd5b39f47f9519ab5a1a6745bd8a69d81ce729d8e5e425a7538b5f4f6992bd3804e0376085f5da1c28cf9f4d664cabe64036d0b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000111001\streamer.exe
Filesize
8.4MB

MD5
e75b157e639b54dbd603da6f5274ae7a

SHA1
42bf3073fc63234d2c3f5c937e7ddbd069e8ed4a

SHA256
a0a8fe7208a6065d64ae9c463d64498d1808279d3aa788fa98871bc4d33466cc

SHA512
68683e9a55662322fb5eb266dcff16f26ad2923ba4fe21892d552d2f2409e3aaa86cc6d91f8d26cefbb8f98f99e19d0f5340be3094449bfa7fcd56435692cd03

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000112001\TpWWMUpe0LEV.exe
Filesize
1.2MB

MD5
242214131486132e33ceda794d66ca1f

SHA1
4ce34fd91f5c9e35b8694007b286635663ef9bf2

SHA256
bac402b5749b2da2211db6d2404c1c621ccd0c2e5d492eb6f973b3e2d38dd361

SHA512
031e0904d949cec515f2d6f2b5e4b9c0df03637787ff14f20c58e711c54eec77d1f22aa0cf0f6efd65362c1fc0066645d5d005c6a77fe5b169427cdd42555d29

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000115001\build.exe
Filesize
10.7MB

MD5
6b1eb54b0153066ddbe5595a58e40536

SHA1
adf81c3104e5d62853fa82c2bd9b0a5becb4589a

SHA256
d39627a497bf5f7e89642ef14bb0134193bc12ad18a2eadddf305c4f8d69b0b8

SHA512
104faaa4085c9173274d4e0e468eaf75fb22c4cfe38226e4594e6aa0a1dcb148bde7e5e0756b664f14b680872d2476340ebd69fac883d8e99b20acfb5f5dbf04

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000116001\FILE1.exe
Filesize
1.8MB

MD5
730555fd49759bf66ef4a1d75a9f0519

SHA1
2df98a10c10563a3b6621bd05cadbb6e69919316

SHA256
278cf19cf07ea8e99ea0893a06f72fa6d2cf7b0a68c3fd8fb291a0ece7cb4ead

SHA512
e6e389e819970493cf80e568293dcdcb87ad503efad411ad809575984c4a403cbd69db5363b19f161379729a102cff2c59b795be43f9e38bfffc4d01a03cd20e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000118001\stl.exe
Filesize
511KB

MD5
2d92c64d986c4640e4cb5bc41cb38821

SHA1
bfc8e36ac6e2e8e6d44cfbc421307bbd58036dd5

SHA256
31dd0e69fb3a0a0999aa228d766e36033bbf1e482bdb93912705850badfba7b0

SHA512
4975350e13824fe78e937fe9cf84f86d6de502e588cf219ba2d73a171b74af4382b6b134033cc4cb590a6068299422834192bc52613161d2ee362b6464caa962

Download Submit
C:\Users\Admin\AppData\Local\Temp\6.exe
Filesize
4.8MB

MD5
5bb3677a298d7977d73c2d47b805b9c3

SHA1
91933eb9b40281e59dd7e73d8b7dac77c5e42798

SHA256
85eb3f6ba52fe0fd232f8c3371d87f7d363f821953c344936ab87728ba6a627f

SHA512
d20f862e9fadb5ad12eddaae8c6ebbfa03d67d35c5ca272e185206eb256cd6a89c338ce608c992df715d36a3f1624a507dbe324a057bd412b87438f4a008f33d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7.exe
Filesize
1.8MB

MD5
b60d82b8244e964110f66e7ad34dc37b

SHA1
413eb99c2ab5ea8f43d651b0100e76fc53aeba70

SHA256
a684e5308b5ec3d09a9bd982d7396290f29bcbe67fd9e9b2683545a9b746d94c

SHA512
0641d19e3f3b71f0a8def8eeb19ac9364abc9f9f12762272a41331f3ee7e2a2ef5f96ca7ccbe879c21c3abefb8eafac2a46ac4901c0791be9b391dde754f5bb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
Filesize
1.8MB

MD5
64271b0d8929719937cf9537b61e03e8

SHA1
b72eab115956c43195693f4657dceee61575a1b1

SHA256
ff6f67ad4e10c362c761f86dedf3aebb2c459e707fe6f5790686b8f140da1ea5

SHA512
b6fa3767d468820617d658a199a9bca83fda7e5e7efc73d6816723c6bbb905cbe280a7d2fbe242e1c1f4d36d6cdd078920bd9821b33cc521e2755e20a323a099

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_cffi_backend.pyd
Filesize
177KB

MD5
ebb660902937073ec9695ce08900b13d

SHA1
881537acead160e63fe6ba8f2316a2fbbb5cb311

SHA256
52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd

SHA512
19d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
Filesize
119KB

MD5
87596db63925dbfe4d5f0f36394d7ab0

SHA1
ad1dd48bbc078fe0a2354c28cb33f92a7e64907e

SHA256
92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4

SHA512
e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd
Filesize
154KB

MD5
b5fbc034ad7c70a2ad1eb34d08b36cf8

SHA1
4efe3f21be36095673d949cceac928e11522b29c

SHA256
80a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6

SHA512
e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_sqlite3.pyd
Filesize
95KB

MD5
7f61eacbbba2ecf6bf4acf498fa52ce1

SHA1
3174913f971d031929c310b5e51872597d613606

SHA256
85de6d0b08b5cc1f2c3225c07338c76e1cab43b4de66619824f7b06cb2284c9e

SHA512
a5f6f830c7a5fadc3349b42db0f3da1fddb160d7e488ea175bf9be4732a18e277d2978720c0e294107526561a7011fadab992c555d93e77d4411528e7c4e695a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\cryptography\hazmat\bindings\_rust.pyd
Filesize
6.9MB

MD5
f918173fbdc6e75c93f64784f2c17050

SHA1
163ef51d4338b01c3bc03d6729f8e90ae39d8f04

SHA256
2c7a31dec06df4eec6b068a0b4b009c8f52ef34ace785c8b584408cb29ce28fd

SHA512
5405d5995e97805e68e91e1f191dc5e7910a7f2ba31619eb64aff54877cbd1b3fa08b7a24b411d095edb21877956976777409d3db58d29da32219bf578ce4ef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-1_1.dll
Filesize
3.3MB

MD5
ab01c808bed8164133e5279595437d3d

SHA1
0f512756a8db22576ec2e20cf0cafec7786fb12b

SHA256
9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55

SHA512
4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-7.dll
Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dll
Filesize
682KB

MD5
de72697933d7673279fb85fd48d1a4dd

SHA1
085fd4c6fb6d89ffcc9b2741947b74f0766fc383

SHA256
ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f

SHA512
0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\sqlite3.dll
Filesize
1.4MB

MD5
926dc90bd9faf4efe1700564aa2a1700

SHA1
763e5af4be07444395c2ab11550c70ee59284e6d

SHA256
50825ea8b431d86ec228d9fa6b643e2c70044c709f5d9471d779be63ff18bcd0

SHA512
a8703ff97243aa3bc877f71c0514b47677b48834a0f2fee54e203c0889a79ce37c648243dbfe2ee9e1573b3ca4d49c334e9bfe62541653125861a5398e2fe556

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp29FF.tmp
Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rlpauy1w.bqe.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2400_133640051299857577\python3.dll
Filesize
63KB

MD5
07bd9f1e651ad2409fd0b7d706be6071

SHA1
dfeb2221527474a681d6d8b16a5c378847c59d33

SHA256
5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5

SHA512
def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2400_133640051299857577\python310.dll
Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_2400_133640051299857577\stub.exe
Filesize
18.0MB

MD5
f0587004f479243c18d0ccff0665d7f6

SHA1
b3014badadfffdd6be2931a77a9df4673750fee7

SHA256
8ce148c264ce50e64ab866e34759de81b816a3f54b21c3426513bed3f239649a

SHA512
6dedaa729ee93520907ce46054f0573fb887ac0890bea9d1d22382e9d05f8c14a8c151fe2061a0ec1dae791b13752e0fbc00ccc85838caa7524edba35d469434

Download Submit
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
Filesize
81KB

MD5
a4b636201605067b676cc43784ae5570

SHA1
e9f49d0fc75f25743d04ce23c496eb5f89e72a9a

SHA256
f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c

SHA512
02096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488

Download Submit
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
Filesize
75KB

MD5
e137df498c120d6ac64ea1281bcab600

SHA1
b515e09868e9023d43991a05c113b2b662183cfe

SHA256
8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a

SHA512
cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90

Download Submit
\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
Filesize
155KB

MD5
35f66ad429cd636bcad858238c596828

SHA1
ad4534a266f77a9cdce7b97818531ce20364cb65

SHA256
58b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc

SHA512
1cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad

Download Submit
\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd
Filesize
28KB

MD5
adc412384b7e1254d11e62e451def8e9

SHA1
04e6dff4a65234406b9bc9d9f2dcfe8e30481829

SHA256
68b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1

SHA512
f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07

Download Submit
\Users\Admin\AppData\Local\Temp\onefile_2400_133640051299857577\vcruntime140.dll
Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
\Users\Admin\AppData\Roaming\d3d9.dll
Filesize
279KB

MD5
8fa26f1e37d3ff7f736fc93d520bc8ab

SHA1
ad532e1cb4a1b3cd82c7a85647f8f6dd99833bb1

SHA256
6c47da8fbd12f22d7272fbf223e054bf5093c0922d0e8fb7d6289a5913c2e45d

SHA512
8a0b53cbc3a20e2f0fd41c486b1af1fbbcf7f2fed9f7368b672a07f25faaa2568bbdbcf0841233ac8c473a4d1dee099e90bf6098a6fa15e44b8526efdafc1287

Download Submit
memory/344-674-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/804-200-0x000001C6A40C0000-0x000001C6A41C0000-memory.dmp

Filesize
1024KB

Download
memory/1336-669-0x0000000006DC0000-0x0000000006E0B000-memory.dmp

Filesize
300KB

Download
memory/1336-661-0x0000000006400000-0x0000000006476000-memory.dmp

Filesize
472KB

Download
memory/1336-666-0x0000000006B80000-0x0000000006B9E000-memory.dmp

Filesize
120KB

Download
memory/1336-632-0x0000000000FC0000-0x0000000001012000-memory.dmp

Filesize
328KB

Download
memory/1452-14-0x00000000011A0000-0x0000000001652000-memory.dmp

Filesize
4.7MB

Download
memory/1452-5-0x00000000011A0000-0x0000000001652000-memory.dmp

Filesize
4.7MB

Download
memory/1452-3-0x00000000011A0000-0x0000000001652000-memory.dmp

Filesize
4.7MB

Download
memory/1452-2-0x00000000011A1000-0x00000000011CF000-memory.dmp

Filesize
184KB

Download
memory/1452-1-0x0000000077EA4000-0x0000000077EA5000-memory.dmp

Filesize
4KB

Download
memory/1452-0-0x00000000011A0000-0x0000000001652000-memory.dmp

Filesize
4.7MB

Download
memory/2216-664-0x0000000000330000-0x00000000003B6000-memory.dmp

Filesize
536KB

Download
memory/2376-359-0x0000022AC0000000-0x0000022AC001C000-memory.dmp

Filesize
112KB

Download
memory/2376-365-0x0000022AC01D0000-0x0000022AC0289000-memory.dmp

Filesize
740KB

Download
memory/2376-398-0x0000022AC0020000-0x0000022AC002A000-memory.dmp

Filesize
40KB

Download
memory/2636-213-0x000002A00B910000-0x000002A00BA10000-memory.dmp

Filesize
1024KB

Download
memory/2636-214-0x000002A00B910000-0x000002A00BA10000-memory.dmp

Filesize
1024KB

Download
memory/2636-216-0x000002A00B4F0000-0x000002A00B4F2000-memory.dmp

Filesize
8KB

Download
memory/2636-219-0x000002A00B620000-0x000002A00B622000-memory.dmp

Filesize
8KB

Download
memory/2636-221-0x000002A00B640000-0x000002A00B642000-memory.dmp

Filesize
8KB

Download
memory/2636-223-0x000002A00B660000-0x000002A00B662000-memory.dmp

Filesize
8KB

Download
memory/2704-137-0x0000000000400000-0x000000000236B000-memory.dmp

Filesize
31.4MB

Download
memory/2764-89-0x0000000005460000-0x00000000054C6000-memory.dmp

Filesize
408KB

Download
memory/2764-75-0x00000000049E0000-0x0000000004A72000-memory.dmp

Filesize
584KB

Download
memory/2764-74-0x0000000004E40000-0x000000000533E000-memory.dmp

Filesize
5.0MB

Download
memory/2764-81-0x0000000004C60000-0x0000000004C9E000-memory.dmp

Filesize
248KB

Download
memory/2764-73-0x00000000000F0000-0x0000000000140000-memory.dmp

Filesize
320KB

Download
memory/2764-141-0x0000000007D50000-0x000000000827C000-memory.dmp

Filesize
5.2MB

Download
memory/2764-140-0x0000000007650000-0x0000000007812000-memory.dmp

Filesize
1.8MB

Download
memory/2764-79-0x0000000004D30000-0x0000000004E3A000-memory.dmp

Filesize
1.0MB

Download
memory/2764-80-0x0000000004BF0000-0x0000000004C02000-memory.dmp

Filesize
72KB

Download
memory/2764-139-0x0000000000880000-0x00000000008D0000-memory.dmp

Filesize
320KB

Download
memory/2764-82-0x0000000004CA0000-0x0000000004CEB000-memory.dmp

Filesize
300KB

Download
memory/2764-78-0x0000000005950000-0x0000000005F56000-memory.dmp

Filesize
6.0MB

Download
memory/2764-76-0x00000000049A0000-0x00000000049AA000-memory.dmp

Filesize
40KB

Download
memory/2872-20-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/2872-21-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/3300-290-0x00000152DABA0000-0x00000152DABC2000-memory.dmp

Filesize
136KB

Download
memory/3300-293-0x00000152DADA0000-0x00000152DAE16000-memory.dmp

Filesize
472KB

Download
memory/3328-244-0x0000026AE4BD0000-0x0000026AE4BD1000-memory.dmp

Filesize
4KB

Download
memory/3328-172-0x0000026ADE520000-0x0000026ADE530000-memory.dmp

Filesize
64KB

Download
memory/3328-243-0x0000026AE4BC0000-0x0000026AE4BC1000-memory.dmp

Filesize
4KB

Download
memory/3328-156-0x0000026ADE420000-0x0000026ADE430000-memory.dmp

Filesize
64KB

Download
memory/3328-191-0x0000026ADD6C0000-0x0000026ADD6C2000-memory.dmp

Filesize
8KB

Download
memory/3396-38-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/3396-37-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/3572-108-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/3572-123-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/3628-252-0x0000000000870000-0x00000000009A2000-memory.dmp

Filesize
1.2MB

Download
memory/4112-665-0x0000000000C70000-0x0000000000CCC000-memory.dmp

Filesize
368KB

Download
memory/4248-676-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4248-672-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4436-281-0x0000000001220000-0x00000000016BA000-memory.dmp

Filesize
4.6MB

Download
memory/4436-284-0x0000000001220000-0x00000000016BA000-memory.dmp

Filesize
4.6MB

Download
memory/4524-611-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/4712-30-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-22-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-136-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-34-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-33-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-32-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-31-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-105-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-99-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-29-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-23-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-40-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-253-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-138-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-104-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-18-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-17-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-103-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-16-0x0000000000801000-0x000000000082F000-memory.dmp

Filesize
184KB

Download
memory/4712-77-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/4712-15-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/5316-719-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download
memory/5316-721-0x0000000000800000-0x0000000000CB2000-memory.dmp

Filesize
4.7MB

Download