52972a23ab12b95cd51d71741db2cf276749e56030c092e2e4f0907dcb1fbd56

max time kernel
188s
max time network
211s
platform
windows7_x64
resource
win7-20220901-de
resource tags

arch:x64arch:x86image:win7-20220901-delocale:de-deos:windows7-x64systemwindows
submitted
26-11-2022 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fucker script.exe
Size

104KB
MD5

db0655efbe0dbdef1df06207f5cb5b5b
SHA1

a8d48d5c0042ce359178d018c0873e8a7c2f27e8
SHA256

52972a23ab12b95cd51d71741db2cf276749e56030c092e2e4f0907dcb1fbd56
SHA512

5adc8463c3e148a66f8afdeefc31f2b3ffeb12b7641584d1d24306b0898da60a8b9b948bb4f9b7d693185f2daa9bd9437b3b84cebc0eabfa84dfcef6938e1704
SSDEEP

1536:m5iT3FccnYWkyjWpOku3yUyJCbyVAvy7+fRo:3LOcxkyjW3wvHq

Score

6^/10

collection

Malware Config

Signatures

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

Processes:

OUTLOOK.EXE

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE
Key queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OUTLOOK.EXE
Key queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	OUTLOOK.EXE

Drops file in System32 directory 14 IoCs

Processes:

OUTLOOK.EXE

description	ioc	process
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE

Drops file in Windows directory 3 IoCs

Processes:

OUTLOOK.EXE

description	ioc	process
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeOUTLOOK.EXEiexplore.exehelppane.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff19000000190000009f0400007e020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LinksExplorer\Width = "269"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LinksExplorer\Width = "270"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	helppane.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\aliexpress.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3200000032000000b804000097020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LinksExplorer\Width = "271"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LinksExplorer\LinksType = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff19000000190000009f0400007e020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LinksExplorer\Docked = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 401979bd4d01d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LinksExplorer\Width = "271"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\de-DE = "de-DE.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LinksExplorer\Docked = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious behavior: AddClipboardFormatListener 60 IoCs

Processes:

OUTLOOK.EXEvlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exe

pid	process
1528	OUTLOOK.EXE
2444	vlc.exe
2392	vlc.exe
2708	vlc.exe
2776	vlc.exe
2972	vlc.exe
2616	vlc.exe
3080	vlc.exe
3196	vlc.exe
3452	vlc.exe
3676	vlc.exe
3696	vlc.exe
3888	vlc.exe
3076	vlc.exe
3148	vlc.exe
3844	vlc.exe
3664	vlc.exe
4148	vlc.exe
4292	vlc.exe
4452	vlc.exe
4696	vlc.exe
4884	vlc.exe
5016	vlc.exe
4664	vlc.exe
4828	vlc.exe
3184	vlc.exe
1380	vlc.exe
5568	vlc.exe
5848	vlc.exe
5888	vlc.exe
5928	vlc.exe
3620	vlc.exe
4676	vlc.exe
3964	vlc.exe
4684	vlc.exe
2312	vlc.exe
1532	vlc.exe
1360	vlc.exe
5788	vlc.exe
4468	vlc.exe
5260	vlc.exe
6200	vlc.exe
6300	vlc.exe
6372	vlc.exe
6568	vlc.exe
6648	vlc.exe
6800	vlc.exe
6772	vlc.exe
7008	vlc.exe
6156	vlc.exe
6576	vlc.exe
6560	vlc.exe
7208	vlc.exe
7352	vlc.exe
7360	vlc.exe
7460	vlc.exe
7712	vlc.exe
7800	vlc.exe
7836	vlc.exe
8100	vlc.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

chrome.exechrome.exe

pid process

1888 chrome.exe
2004 chrome.exe
2004 chrome.exe
2004 chrome.exe
2004 chrome.exe

pid	process
1888	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 60 IoCs

Processes:

vlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exeiexplore.exe

pid	process
2444	vlc.exe
2392	vlc.exe
2708	vlc.exe
2776	vlc.exe
2972	vlc.exe
2616	vlc.exe
3080	vlc.exe
3196	vlc.exe
3452	vlc.exe
3676	vlc.exe
3696	vlc.exe
3888	vlc.exe
3076	vlc.exe
3148	vlc.exe
3844	vlc.exe
3664	vlc.exe
4148	vlc.exe
4292	vlc.exe
4452	vlc.exe
4696	vlc.exe
4884	vlc.exe
5016	vlc.exe
4664	vlc.exe
4828	vlc.exe
3184	vlc.exe
1380	vlc.exe
5568	vlc.exe
5928	vlc.exe
5848	vlc.exe
5888	vlc.exe
3620	vlc.exe
4676	vlc.exe
3964	vlc.exe
4684	vlc.exe
1360	vlc.exe
2312	vlc.exe
1532	vlc.exe
5788	vlc.exe
4468	vlc.exe
5260	vlc.exe
6200	vlc.exe
6300	vlc.exe
6372	vlc.exe
6568	vlc.exe
6648	vlc.exe
6772	vlc.exe
6800	vlc.exe
7008	vlc.exe
6156	vlc.exe
6560	vlc.exe
7352	vlc.exe
7208	vlc.exe
6576	vlc.exe
7360	vlc.exe
7460	vlc.exe
7712	vlc.exe
7836	vlc.exe
7800	vlc.exe
8100	vlc.exe
996	iexplore.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

helppane.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	7792	helppane.exe
Token: SeTakeOwnershipPrivilege	7792	helppane.exe
Token: SeTakeOwnershipPrivilege	7792	helppane.exe
Token: SeTakeOwnershipPrivilege	7792	helppane.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exeiexplore.exeiexplore.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exe

pid	process
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
996	iexplore.exe
1884	iexplore.exe
2444	vlc.exe
2708	vlc.exe
2392	vlc.exe
2776	vlc.exe
2004	chrome.exe
2444	vlc.exe
2972	vlc.exe
2708	vlc.exe
2392	vlc.exe
2776	vlc.exe
2004	chrome.exe
2972	vlc.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2616	vlc.exe
2616	vlc.exe
996	iexplore.exe
3080	vlc.exe
3080	vlc.exe
3196	vlc.exe
3196	vlc.exe
2444	vlc.exe
3452	vlc.exe
3452	vlc.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exe

pid	process
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2444	vlc.exe
2708	vlc.exe
2392	vlc.exe
2776	vlc.exe
2004	chrome.exe
2444	vlc.exe
2972	vlc.exe
2708	vlc.exe
2392	vlc.exe
2776	vlc.exe
2004	chrome.exe
2972	vlc.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2616	vlc.exe
2616	vlc.exe
3080	vlc.exe
3080	vlc.exe
3196	vlc.exe
3196	vlc.exe
3452	vlc.exe
3452	vlc.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

iexplore.exeiexplore.exeOUTLOOK.EXEIEXPLORE.EXEIEXPLORE.EXEvlc.exevlc.exevlc.exevlc.exevlc.exeiexplore.exevlc.exeIEXPLORE.EXEvlc.exevlc.exevlc.exeIEXPLORE.EXEvlc.exevlc.exeIEXPLORE.EXEvlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exevlc.exeIEXPLORE.EXEvlc.exevlc.exevlc.exevlc.exevlc.exe

pid	process
1884	iexplore.exe
1884	iexplore.exe
996	iexplore.exe
996	iexplore.exe
1528	OUTLOOK.EXE
1528	OUTLOOK.EXE
1528	OUTLOOK.EXE
1528	OUTLOOK.EXE
1100	IEXPLORE.EXE
1100	IEXPLORE.EXE
1548	IEXPLORE.EXE
1548	IEXPLORE.EXE
996	iexplore.exe
996	iexplore.exe
2444	vlc.exe
2392	vlc.exe
2708	vlc.exe
2776	vlc.exe
2972	vlc.exe
2372	iexplore.exe
2372	iexplore.exe
2616	vlc.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
3080	vlc.exe
3196	vlc.exe
996	iexplore.exe
996	iexplore.exe
3452	vlc.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
3676	vlc.exe
3696	vlc.exe
3444	IEXPLORE.EXE
3444	IEXPLORE.EXE
3888	vlc.exe
996	iexplore.exe
996	iexplore.exe
3076	vlc.exe
3148	vlc.exe
3844	vlc.exe
3664	vlc.exe
4148	vlc.exe
996	iexplore.exe
996	iexplore.exe
996	iexplore.exe
996	iexplore.exe
4292	vlc.exe
1100	IEXPLORE.EXE
1100	IEXPLORE.EXE
4452	vlc.exe
4592	IEXPLORE.EXE
4592	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
4696	vlc.exe
4884	vlc.exe
5016	vlc.exe
996	iexplore.exe
996	iexplore.exe
3444	IEXPLORE.EXE
3444	IEXPLORE.EXE
4664	vlc.exe
4828	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exeiexplore.exeiexplore.exe

description	pid	process	target process
PID 2004 wrote to memory of 816	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 816	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 816	2004	chrome.exe	chrome.exe
PID 1884 wrote to memory of 1548	1884	iexplore.exe	IEXPLORE.EXE
PID 1884 wrote to memory of 1548	1884	iexplore.exe	IEXPLORE.EXE
PID 1884 wrote to memory of 1548	1884	iexplore.exe	IEXPLORE.EXE
PID 1884 wrote to memory of 1548	1884	iexplore.exe	IEXPLORE.EXE
PID 996 wrote to memory of 1100	996	iexplore.exe	IEXPLORE.EXE
PID 996 wrote to memory of 1100	996	iexplore.exe	IEXPLORE.EXE
PID 996 wrote to memory of 1100	996	iexplore.exe	IEXPLORE.EXE
PID 996 wrote to memory of 1100	996	iexplore.exe	IEXPLORE.EXE
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 108	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 1888	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 1888	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 1888	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 1160	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 1160	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 1160	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 1160	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 1160	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 1160	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 1160	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 1160	2004	chrome.exe	chrome.exe
PID 2004 wrote to memory of 1160	2004	chrome.exe	chrome.exe

outlook_win_path 1 IoCs

Processes:

OUTLOOK.EXE

description	ioc	process
Key queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	OUTLOOK.EXE

C:\Users\Admin\AppData\Local\Temp\fucker script.exe
"C:\Users\Admin\AppData\Local\Temp\fucker script.exe"
1⤵
PID:612

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1884 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1548

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:275457 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:1100

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:3421186 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2456

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:4142084 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:3444

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:3486740 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:4592

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:275475 /prefetch:2
2⤵
PID:5208

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:1782862 /prefetch:2
2⤵
- Modifies Internet Explorer settings
PID:7700

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:1651783 /prefetch:2
2⤵
- Modifies Internet Explorer settings
PID:4648

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:1782885 /prefetch:2
2⤵
PID:8776

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:996 CREDAT:668728 /prefetch:2
2⤵
- Modifies Internet Explorer settings
PID:6448

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6234f50,0x7fef6234f60,0x7fef6234f70
2⤵
PID:816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1076,7184065260635672587,5644349549832354684,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1088 /prefetch:2
2⤵
PID:108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1076,7184065260635672587,5644349549832354684,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1424 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1888

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1076,7184065260635672587,5644349549832354684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1700 /prefetch:8
2⤵
PID:1160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1076,7184065260635672587,5644349549832354684,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:1
2⤵
PID:2060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1076,7184065260635672587,5644349549832354684,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2076 /prefetch:1
2⤵
PID:2068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1076,7184065260635672587,5644349549832354684,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2428 /prefetch:2
2⤵
PID:2664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1076,7184065260635672587,5644349549832354684,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2840 /prefetch:1
2⤵
PID:7276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,7184065260635672587,5644349549832354684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3444 /prefetch:8
2⤵
PID:7776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,7184065260635672587,5644349549832354684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3580 /prefetch:8
2⤵
PID:7788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1076,7184065260635672587,5644349549832354684,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
2⤵
PID:4736

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,7184065260635672587,5644349549832354684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3960 /prefetch:8
2⤵
PID:9048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1076,7184065260635672587,5644349549832354684,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3952 /prefetch:8
2⤵
PID:9040

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
- Accesses Microsoft Outlook profiles
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- outlook_win_path
PID:1528

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2372

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
2⤵
- Suspicious use of SetWindowsHookEx
PID:2080

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:2384

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2392

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2444

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:2468

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:2576

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:2656

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2708

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:2728

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:2752

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2776

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:2840

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2972

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2616

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:2700

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:2920

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:3016

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3080

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:3112

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3196

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:3208

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:3220

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:3248

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:3268

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:3316

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:3412

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3452

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:3636

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3676

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:3688

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3696

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:3764

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:3832

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3888

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:3984

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"
1⤵
PID:4008

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:4036

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:4060

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:4084

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3076

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3148

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:3228

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3844

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:4092

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:3192

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3664

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:4116

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:4132

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4148

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:4228

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4292

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:4316

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:4356

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:4380

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:4424

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4452

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4696

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:4748

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"
1⤵
PID:4804

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"
1⤵
PID:4856

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:4864

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4884

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
1⤵
PID:4896

C:\Program Files (x86)\Windows Media Player\setup_wm.exe
"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
2⤵
PID:4964

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5016

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:5040

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:5116

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:4112

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:4400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6234f50,0x7fef6234f60,0x7fef6234f70
2⤵
PID:4372

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4664

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4828

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:4880

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
1⤵
PID:1676

C:\Program Files (x86)\Windows Media Player\setup_wm.exe
"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
2⤵
PID:4124

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:3184

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:4948

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:4376

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:4820

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:1380

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:5172

C:\Windows\system32\SndVol.exe
SndVol.exe -f 38273431 6
1⤵
PID:5180

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:5492

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:5548

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:5568

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"
1⤵
PID:5648

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:5668

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:5720

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:5744

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:5752

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:5780

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:5808

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:5816

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:5840

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:5848

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:5888

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:5928

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:6048

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"
1⤵
PID:6104

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:2736

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:4324

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:5168

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:3620

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:4676

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:3964

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:2292

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:5424

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:2200

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:4684

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:2312

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:1532

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:1360

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:5196

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:5788

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:6132

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:6112

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:4468

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:2368

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:5556

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:5260

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:1832

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:5440

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:4536

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:4448

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:6068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:6192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6234f50,0x7fef6234f60,0x7fef6234f70
2⤵
PID:6212

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:6200

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:6300

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:6372

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:6444

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:6480

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:6492

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:6520

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:6568

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:6648

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:6764

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:6772

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:6784

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:6800

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:6828

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:6968

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:7008

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:7156

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:6156

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
PID:1696

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:6780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:6496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6234f50,0x7fef6234f60,0x7fef6234f70
2⤵
PID:6940

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:6252

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:7036

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:6560

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:6576

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"
1⤵
PID:2556

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"
1⤵
PID:1940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:6952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6234f50,0x7fef6234f60,0x7fef6234f70
2⤵
PID:6944

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
1⤵
PID:6524

C:\Program Files (x86)\Windows Media Player\setup_wm.exe
"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
2⤵
PID:7180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:6584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef6234f50,0x7fef6234f60,0x7fef6234f70
2⤵
PID:988

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:6448

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"
1⤵
PID:6216

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:7172

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:7208

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\shell32.dll,Options_RunDLL 1
1⤵
PID:7288

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:7296

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\shell32.dll,Options_RunDLL 1
1⤵
PID:7360

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:7352

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\shell32.dll,Options_RunDLL 1
1⤵
PID:6824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:7384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6234f50,0x7fef6234f60,0x7fef6234f70
2⤵
PID:6192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:2784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef6234f50,0x7fef6234f60,0x7fef6234f70
2⤵
PID:7472

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\shell32.dll,Options_RunDLL 1
1⤵
PID:6952

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"
1⤵
PID:6208

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"
1⤵
PID:6944

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:7452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:7180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6234f50,0x7fef6234f60,0x7fef6234f70
2⤵
PID:7292

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer settings
PID:7592

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7592 CREDAT:275457 /prefetch:2
2⤵
PID:2960

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
1⤵
PID:3896

C:\Program Files (x86)\Windows Media Player\setup_wm.exe
"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
2⤵
PID:7868

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:7784

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:7876

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"
1⤵
PID:2160

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\shell32.dll,Options_RunDLL 1
1⤵
PID:4488

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:6824

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:6192

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:3044

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:7460

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
1⤵
PID:7472

C:\Program Files (x86)\Windows Media Player\setup_wm.exe
"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
2⤵
PID:4972

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:7572

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:7308

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:7716

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:7712

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:7360

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:5304

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:5996

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:1044

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:7800

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:7824

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:5880

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:4816

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:2288

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:1784

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:7836

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:8100

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:5308

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:7792

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:3876

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:6032

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:5232

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" SYSTEM
1⤵
PID:7328

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:8196

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:8332

C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
"C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE"
1⤵
PID:8340

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\shell32.dll,Options_RunDLL 1
1⤵
PID:8412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:8428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6234f50,0x7fef6234f60,0x7fef6234f70
2⤵
PID:8444

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"
1⤵
PID:8508

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\shell32.dll,Options_RunDLL 1
1⤵
PID:8520

C:\Windows\system32\calc.exe
"C:\Windows\system32\calc.exe"
1⤵
PID:8536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:8676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6234f50,0x7fef6234f60,0x7fef6234f70
2⤵
PID:8692

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"
1⤵
PID:8700

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
1⤵
PID:8864

C:\Program Files (x86)\Windows Media Player\setup_wm.exe
"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:1
2⤵
PID:8892

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE"
1⤵
PID:8916

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\shell32.dll,Options_RunDLL 1
1⤵
PID:8928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:8936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6234f50,0x7fef6234f60,0x7fef6234f70
2⤵
PID:8956

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:9016

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
PID:7328

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe"
1⤵
PID:8212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:8680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6234f50,0x7fef6234f60,0x7fef6234f70
2⤵
PID:8676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c5cd6dfdcdac00d1dbe87956af61618f

SHA1
1f75da2951d23c7330c626fdba58edbec4a43a81

SHA256
eeb1d4ea604cf9e25e0d698f35f91f9e80f608474f7430e6642a43f746bced13

SHA512
fc2c66bb50d6d62a6f8e2d712049e9c6d50d94122780045326d09e45511ee41ec490f579ec88a89c5b5cc0077aec48d56c8d03b51333fa3f4dbc0a4b42c7d36d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a66215c47e63748efe71babdd362d641

SHA1
e1de1bae238c40d2a180d995254d389dc575fc61

SHA256
28000ac1e0d7dd95bb97f330df72d44d6584e651d054ddc961328e9c3ccfc4a6

SHA512
69e35b30061f0e0f5d16d117e304931d55035602d0e9309bd7eea691787870562dcde48b278d5019d0373ee4d7968c104158fbc28e0ecca07c829a378e523e23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a427290dcd46db8511a888f38655e463

SHA1
fc2410070f65b60c927e2e0d83e44ef7325f8d84

SHA256
9997978d0e3255daa7304557bdfae3da38ac8e71aa8d8a69e796df0336848c8f

SHA512
a7ed31189cb983038374bec39797886a220a0a75600bb09ed2c5a5556831c1ab8da57af25d38d9e3a00a141f3bca23e87ebc409e04e5e25141319d2f30567793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a427290dcd46db8511a888f38655e463

SHA1
fc2410070f65b60c927e2e0d83e44ef7325f8d84

SHA256
9997978d0e3255daa7304557bdfae3da38ac8e71aa8d8a69e796df0336848c8f

SHA512
a7ed31189cb983038374bec39797886a220a0a75600bb09ed2c5a5556831c1ab8da57af25d38d9e3a00a141f3bca23e87ebc409e04e5e25141319d2f30567793

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
1cd6ef8dbe0b30c5972ae237826ec3a5

SHA1
554d56cde3a6db16c96a69fc9e8b142dcec0ea95

SHA256
848b0488aedb73f585ab1a2a5e48d3c9ae27c8645bd01b0c251fbfeffc565a80

SHA512
873d6afcc34ac31965af4a26b9f691629936058cd29083b096148fd7edf310c612ccc29005117e929fd894bbe1f74162bc554d937c8679a7127837b52b072b01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
e96be8a1efecd6c2b040fb61c71360ee

SHA1
8770c071b309eca327213bd14c192281082529f9

SHA256
a22db4c072c30288a896957d2a93809ce1ca242b44e5b50f4c87b71951bb09a0

SHA512
2a35bd23be57ae241ae91b0586b0ae8abcbd77604ebb4c041d1f6e9e1cf984ae9c621fabee18a21eb7176f7efb0ba855fc7588cb94abeaefd88a49682aa53961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
cecbe616131d66e9766f09fc50427a0c

SHA1
124f1721c4bd716774b6bbaea0440c7d5d2ae859

SHA256
2570e5f18945ff014c8d0d4c730b88e7ef2aa48f823b77666a53f7fc4088b6e9

SHA512
4a525fc0a90a14768d732a3cf9598c7e3a44cb1e3b0b4b0cab0dd3c2b30b97dfebb8b2449b04543cb264affb1d175e12eab81281da2dd7d74557dd67e20edbdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
56216ac5700bae226bc512d26328e00f

SHA1
16df2189a3c9a16d5e15bd3366c1fac11f2d84ad

SHA256
49eb70b8942c2bfbaf03ad260f592599b882b733b1a76f85f52273544d8c8ac6

SHA512
449811b82dfa1eba76dbdfe1dceb91f61c3d5ee4aaae59fbca548410c695434ed81d8887be822f9cb6fc84cc56cae2379ca00e89fb20a4436d8ef5e9e4ff792c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
52963ab9bdbab35a3d307b297ff38dd8

SHA1
d3bee30b430be46ba622047413e70d1ddee84f95

SHA256
db61322d6e396576962c8e0dcbcc56f7b4b1c070f32f676bb74ac66ab04ec2db

SHA512
41634e82615851dfd284b55bca2e1a0a27facb348db58716e11ce623481b1e67f46e7c07b0c6ccf6ec784594b49ab4c0116ce3f7d983a64cd913f2a23ee475f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a2dcb789675dc5c66b4b59459c721e43

SHA1
377c67ba765ab811568e64037c739a79d01098d9

SHA256
095bdb292096c4847cb2ca376f3782df81fbe5e8e1975361c016f17ca14951b8

SHA512
fe946bab7f987a24712a2b63f252bf17d8cd59ecbaa8b8b65c379bebd501ed54f7484b3b23c3510926c2dd6f0d0555a8ee92ff1263494aa00218c35e521e2cbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
23ff60c818b4e03f7649df5db725e1aa

SHA1
878d292dc4762af4c1c7ac69b816e0fdd50eaf94

SHA256
2407e26449262fe1fe5d790a919379e411946934178b49f6fa4268b17eae45e6

SHA512
6753056abff338d0df7941c0ce515f071df2ef7ca369c38012bdaccaabd39249dace93430dc33cc6443b8e345f5362695c5e01b49ef3a61d5922e19c884725c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
2a37e071deaf2ba3b51f34b40b55c1e3

SHA1
1463e86e7b3a24fc3cb1c7d9bb77403ceda5953c

SHA256
a20c563c069dabe45f7fcf4c9df05ec4d8406d4ba1850f9fed1305f729924512

SHA512
a21edb59c9dde0feb9a5205682ca898d8bacfa81d929178a3d2ba5cac7da210a5dae21ab042548479f4ddaf74ce90eaba9b27460ae58c6741de01ff2e7112017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
2a1f7a025c3e62267753b2cd9e2fb3c9

SHA1
d920479139743e226c29ce9164a08e39269feb7a

SHA256
0fdd8df0fc0775564b05274668ec8b55a531f619adae7cc0d3541e710808ed29

SHA512
47712a63b23f110e13e54062f059b0879c8fc59c44a2e96bb2c402d18a5f9b311b3f1aa1bc723a68912fb53ea4f6a94dce66436353b832cff3e04210fb9ce0b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
810bdd8ff8227653004c3697140b99b2

SHA1
39572fc94662415be5946f684f0b429998b2e2a5

SHA256
9eca3bae4a1fe8ce97b801368ae5470aa8776aa73f46f9f4638ae7a2ef9c0a49

SHA512
f6c18a695d732a705a54b1eb8470e8a2599f9d17d1d35aa887c0cbd7355e47d79a4ad1dc6df78f1366e9d8d63da98bad6832cde11a332485e6df4a99eb3a069c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
d5a5aad973c046241d9fbccb149ca88d

SHA1
9662b56144e40fcbd5302ec66f8fbf46bdcd26ad

SHA256
568d60eb62a0c1cb68f8527086a0e7c045e36f6791ca268d69e8c2ad2a626f8c

SHA512
48c3b6c75816848fb0f356068a744e9bc3dfea4fd9adc81cce68f019c5927c18157dbeb95dbca1fa0984e3c51e7d5d1dc1162c9539394c5075c71c94b82f2218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
3a27eb5bce1d1c4b0bbec2841dbdf2d1

SHA1
0ed677a3543711ea2ff9b74928cdbed0a8753596

SHA256
1442c30a60b6268815f2b2d7fc25d2b220514a8f47f0e1d6bb6423ed8c3e1123

SHA512
5b9a3121ff455156e9cab4b805bb1be4ac471395899ce1ef77e00fae95cea2afde5ba46c30c8ee39f48a499db0c6d36379eeecd356ba3a24bf07d829cd5831b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
1d3cff7b324f6a68ac1e23ac36f6549f

SHA1
d2b1d8d4c0e9163f8993624919bb912efd832df9

SHA256
5de40636aa7330518f79af667541d4f83b0578964d1ed13b8d63f0ae07e90015

SHA512
59896a8e40536596b63c23a5e1bc1e61f5bac364755c4ca61685e3cf90227e7c7262f3aefc8bf9234d585244e83867518a6289e466b66e32d26a2e5f2a050bc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
fc80069047253d14d66fd16a255ad052

SHA1
8d3e6dce271e7ba912de2210f45a660471545c18

SHA256
38a76ddc389cf166479defcfd4317d44780584376d13350aaab69a6b5e96c693

SHA512
4e64e4d6d9c0a457ea95de1bbb204ec91d35e9bf1f3c027c954c575ed9be2e0cbdeea633f8f3eec8c235c27c9f99ed5aa502058037ce569279fc5de46900f93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
fc80069047253d14d66fd16a255ad052

SHA1
8d3e6dce271e7ba912de2210f45a660471545c18

SHA256
38a76ddc389cf166479defcfd4317d44780584376d13350aaab69a6b5e96c693

SHA512
4e64e4d6d9c0a457ea95de1bbb204ec91d35e9bf1f3c027c954c575ed9be2e0cbdeea633f8f3eec8c235c27c9f99ed5aa502058037ce569279fc5de46900f93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
fc80069047253d14d66fd16a255ad052

SHA1
8d3e6dce271e7ba912de2210f45a660471545c18

SHA256
38a76ddc389cf166479defcfd4317d44780584376d13350aaab69a6b5e96c693

SHA512
4e64e4d6d9c0a457ea95de1bbb204ec91d35e9bf1f3c027c954c575ed9be2e0cbdeea633f8f3eec8c235c27c9f99ed5aa502058037ce569279fc5de46900f93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
fc80069047253d14d66fd16a255ad052

SHA1
8d3e6dce271e7ba912de2210f45a660471545c18

SHA256
38a76ddc389cf166479defcfd4317d44780584376d13350aaab69a6b5e96c693

SHA512
4e64e4d6d9c0a457ea95de1bbb204ec91d35e9bf1f3c027c954c575ed9be2e0cbdeea633f8f3eec8c235c27c9f99ed5aa502058037ce569279fc5de46900f93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
fc80069047253d14d66fd16a255ad052

SHA1
8d3e6dce271e7ba912de2210f45a660471545c18

SHA256
38a76ddc389cf166479defcfd4317d44780584376d13350aaab69a6b5e96c693

SHA512
4e64e4d6d9c0a457ea95de1bbb204ec91d35e9bf1f3c027c954c575ed9be2e0cbdeea633f8f3eec8c235c27c9f99ed5aa502058037ce569279fc5de46900f93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
fc80069047253d14d66fd16a255ad052

SHA1
8d3e6dce271e7ba912de2210f45a660471545c18

SHA256
38a76ddc389cf166479defcfd4317d44780584376d13350aaab69a6b5e96c693

SHA512
4e64e4d6d9c0a457ea95de1bbb204ec91d35e9bf1f3c027c954c575ed9be2e0cbdeea633f8f3eec8c235c27c9f99ed5aa502058037ce569279fc5de46900f93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
fc80069047253d14d66fd16a255ad052

SHA1
8d3e6dce271e7ba912de2210f45a660471545c18

SHA256
38a76ddc389cf166479defcfd4317d44780584376d13350aaab69a6b5e96c693

SHA512
4e64e4d6d9c0a457ea95de1bbb204ec91d35e9bf1f3c027c954c575ed9be2e0cbdeea633f8f3eec8c235c27c9f99ed5aa502058037ce569279fc5de46900f93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
fc80069047253d14d66fd16a255ad052

SHA1
8d3e6dce271e7ba912de2210f45a660471545c18

SHA256
38a76ddc389cf166479defcfd4317d44780584376d13350aaab69a6b5e96c693

SHA512
4e64e4d6d9c0a457ea95de1bbb204ec91d35e9bf1f3c027c954c575ed9be2e0cbdeea633f8f3eec8c235c27c9f99ed5aa502058037ce569279fc5de46900f93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
fc80069047253d14d66fd16a255ad052

SHA1
8d3e6dce271e7ba912de2210f45a660471545c18

SHA256
38a76ddc389cf166479defcfd4317d44780584376d13350aaab69a6b5e96c693

SHA512
4e64e4d6d9c0a457ea95de1bbb204ec91d35e9bf1f3c027c954c575ed9be2e0cbdeea633f8f3eec8c235c27c9f99ed5aa502058037ce569279fc5de46900f93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
fc80069047253d14d66fd16a255ad052

SHA1
8d3e6dce271e7ba912de2210f45a660471545c18

SHA256
38a76ddc389cf166479defcfd4317d44780584376d13350aaab69a6b5e96c693

SHA512
4e64e4d6d9c0a457ea95de1bbb204ec91d35e9bf1f3c027c954c575ed9be2e0cbdeea633f8f3eec8c235c27c9f99ed5aa502058037ce569279fc5de46900f93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
fc80069047253d14d66fd16a255ad052

SHA1
8d3e6dce271e7ba912de2210f45a660471545c18

SHA256
38a76ddc389cf166479defcfd4317d44780584376d13350aaab69a6b5e96c693

SHA512
4e64e4d6d9c0a457ea95de1bbb204ec91d35e9bf1f3c027c954c575ed9be2e0cbdeea633f8f3eec8c235c27c9f99ed5aa502058037ce569279fc5de46900f93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
fc80069047253d14d66fd16a255ad052

SHA1
8d3e6dce271e7ba912de2210f45a660471545c18

SHA256
38a76ddc389cf166479defcfd4317d44780584376d13350aaab69a6b5e96c693

SHA512
4e64e4d6d9c0a457ea95de1bbb204ec91d35e9bf1f3c027c954c575ed9be2e0cbdeea633f8f3eec8c235c27c9f99ed5aa502058037ce569279fc5de46900f93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
fc80069047253d14d66fd16a255ad052

SHA1
8d3e6dce271e7ba912de2210f45a660471545c18

SHA256
38a76ddc389cf166479defcfd4317d44780584376d13350aaab69a6b5e96c693

SHA512
4e64e4d6d9c0a457ea95de1bbb204ec91d35e9bf1f3c027c954c575ed9be2e0cbdeea633f8f3eec8c235c27c9f99ed5aa502058037ce569279fc5de46900f93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
fc80069047253d14d66fd16a255ad052

SHA1
8d3e6dce271e7ba912de2210f45a660471545c18

SHA256
38a76ddc389cf166479defcfd4317d44780584376d13350aaab69a6b5e96c693

SHA512
4e64e4d6d9c0a457ea95de1bbb204ec91d35e9bf1f3c027c954c575ed9be2e0cbdeea633f8f3eec8c235c27c9f99ed5aa502058037ce569279fc5de46900f93e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Filesize
40B

MD5
fc80069047253d14d66fd16a255ad052

SHA1
8d3e6dce271e7ba912de2210f45a660471545c18

SHA256
38a76ddc389cf166479defcfd4317d44780584376d13350aaab69a6b5e96c693

SHA512
4e64e4d6d9c0a457ea95de1bbb204ec91d35e9bf1f3c027c954c575ed9be2e0cbdeea633f8f3eec8c235c27c9f99ed5aa502058037ce569279fc5de46900f93e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BF1515B1-6D40-11ED-9C2E-4615E282B207}.dat
Filesize
3KB

MD5
c9c9d35bd478be15cb5730b9f3349d6f

SHA1
ef491c3e1aa8bba14708b2b372103a488d294a75

SHA256
bd2fe6994e774204c150b6f39d4ae2aa06b1caa7994f8a7235037976a100de48

SHA512
23cc810adf861f8d76a5bb5a2ba58926e4464baeeec643430c4d29008551bebc8f30ed06be2ec19e0868a77e8b5ce0cbe39aafe768c5f7c7669e32827e73ad84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BF40E871-6D40-11ED-9C2E-4615E282B207}.dat
Filesize
11KB

MD5
ff5a059936b787cd6b26707792196789

SHA1
a7de7907c31a0c2d6b88b217b45d15a606395951

SHA256
f40e9b20748c3a9c93aeb485436824579d2c8346fe1166179dac8f9158dddaea

SHA512
d2df82bd9eed83433c889ae226be0e3f5e55379743db99f7bfc5d833c9b69875002f2409306492cdba78fcaa92563c09e2bb0c05e92a3c81d00e8488222a7555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BF40E871-6D40-11ED-9C2E-4615E282B207}.dat
Filesize
5KB

MD5
c3c0c3d019c616f2c79c5fe0aa22b32d

SHA1
eac956a7f0d27924e28f8037fe73011768b30237

SHA256
7abf1c978802af37cf03fa31114a39d3e85f2ff14c8c3788e6cde3e41b6c386c

SHA512
e3a41d6ddd757471781d3670ab8bc43dc69ce0fba16659d1846f8a46674bf05c3be942d3c15b6fecd8bc4f45939a5e48b3975acd915fe64e68ba026e9c2fd1ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{BF40E871-6D40-11ED-9C2E-4615E282B207}.dat
Filesize
5KB

MD5
5bd924e181e6ba19cb2ab8505e946cde

SHA1
a571ee80db243e284f179d9254993f3021a0efb8

SHA256
4f8390a6b7644bee176058876d22653efc4ce44dac047958dd8f48405e6662ac

SHA512
de969f74f9d67b0e5dfc63dbf08afee9bcbd15878a27e9b4a8795e1a6908a854100138007731c3ce2e27a43a16a8b94483c66418d1bc85a1631c95ae2932ebc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\RecoveryStore.{D8E8D711-6D40-11ED-9C2E-4615E282B207}.dat
Filesize
5KB

MD5
bb6340e28ca90be0c6e2481927e454c3

SHA1
194b1767740e47932aa1461a97f6f4a55abbb16e

SHA256
52d425234db6a1aea46af8e9d850515dff3396052537763bd55c6528ac25c4e7

SHA512
4066fe12c4b29339d740016ae5f5f11fa06eeff982a0bab1d6355a461f6727c8f76458207b4eccbbf87abedfaaea353816a256be3f51268c8316c544a64c2fd9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VPRCRWUX.txt
Filesize
608B

MD5
c75e707a1d3243910e5305e6e1884aaa

SHA1
273a6799f757602de66c2c22bb91c874c098ee82

SHA256
ad06cdad9dc66afa9c3202071a42b54ca86941753ca9c3cbe775a3cc3f4a6988

SHA512
f4ae3fe8701de10b33051035665048644f89b60e0da727cc63ea383a02ea87c86a75e7715ace41f1ccc6b211c8e63e0b7f3adccc3c6d466f02473cf98826c7f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms
Filesize
4KB

MD5
9df886b6776526a82c038ff6cf786112

SHA1
c0f29bf21145603863ad690a8e97cf3d01cc9cd8

SHA256
2cb0c108cd2d630e3d5257d4c69ba810a7e7da6fac97795a4cac4710700e54e5

SHA512
ff85b95aaade81dd981bbc3e0171860ef94cda9979ad7c907154bffadc4c63ddf6f850b6ddf81846f3d84213f5f3f392709881e8564be3763ecf0b554fe01b8c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms
Filesize
4KB

MD5
9df886b6776526a82c038ff6cf786112

SHA1
c0f29bf21145603863ad690a8e97cf3d01cc9cd8

SHA256
2cb0c108cd2d630e3d5257d4c69ba810a7e7da6fac97795a4cac4710700e54e5

SHA512
ff85b95aaade81dd981bbc3e0171860ef94cda9979ad7c907154bffadc4c63ddf6f850b6ddf81846f3d84213f5f3f392709881e8564be3763ecf0b554fe01b8c

Download Submit
\??\pipe\crashpad_2004_YNZXZVCGYQZUGAPI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1380-54-0x000007FEFBE91000-0x000007FEFBE93000-memory.dmp

Filesize
8KB

Download
memory/1528-90-0x000000007235D000-0x0000000072368000-memory.dmp

Filesize
44KB

Download
memory/1528-57-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1528-58-0x000000007235D000-0x0000000072368000-memory.dmp

Filesize
44KB

Download
memory/1528-59-0x0000000075A01000-0x0000000075A03000-memory.dmp

Filesize
8KB

Download
memory/1528-60-0x000000006A861000-0x000000006A864000-memory.dmp

Filesize
12KB

Download
memory/1528-56-0x0000000071371000-0x0000000071373000-memory.dmp

Filesize
8KB

Download
memory/4124-133-0x0000000000000000-mapping.dmp

Download
memory/4964-123-0x0000000000000000-mapping.dmp

Download
memory/4972-264-0x0000000000000000-mapping.dmp

Download
memory/7180-213-0x0000000000000000-mapping.dmp

Download
memory/7868-253-0x0000000000000000-mapping.dmp

Download
memory/8892-300-0x0000000000000000-mapping.dmp

Download