wshrat | 5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2023 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wpp.vbs
Size

257KB
MD5

d87d4c42c10f332a96aa10ffb455f49d
SHA1

c6167ce4e59f14ce826a50e8d32847101e5e9dc8
SHA256

5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a
SHA512

d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a
SSDEEP

384:GWbSLcLgOioL0XHys4KJPlTkXZ64SAzu7t7Q0TDh7O74DJxWO0K6dBjcOXoxAFuR:GZ8BcmuMwg4

Score

10^/10

wshrat persistence trojan

Malware Config

Extracted

Family

wshrat

http://chongmei33.publicvm.com:7045

Signatures

WSHRAT
WSHRAT is a variant of Houdini worm and has vbs and js variants.
trojan wshrat

Blocklisted process makes network request 25 IoCs

flow	pid	Process
21	5052	WScript.exe
23	5052	WScript.exe
28	5052	WScript.exe
29	5052	WScript.exe
31	5052	WScript.exe
41	5052	WScript.exe
42	5052	WScript.exe
43	5052	WScript.exe
44	5052	WScript.exe
45	5052	WScript.exe
48	5052	WScript.exe
49	5052	WScript.exe
50	5052	WScript.exe
51	5052	WScript.exe
55	5052	WScript.exe
57	5052	WScript.exe
66	5052	WScript.exe
71	5052	WScript.exe
204	5052	WScript.exe
404	5052	WScript.exe
483	5052	WScript.exe
488	5052	WScript.exe
489	5052	WScript.exe
500	5052	WScript.exe
502	5052	WScript.exe

Downloads MZ/PE file

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs	WScript.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\wpp.vbs	taskmgr.exe

Executes dropped EXE 4 IoCs

pid	Process
5776	HitmanPro_x64.exe
5312	HitmanPro_x64.exe
4660	HitmanPro_x64.exe
5884	hmpsched.exe

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wpp = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wpp.vbs\""	WScript.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\HitmanPro\HitmanPro.exe	HitmanPro_x64.exe
File created	C:\Program Files\HitmanPro\hmpsched.exe	HitmanPro_x64.exe
File created	C:\Program Files\HitmanPro\HitmanPro.exe	HitmanPro_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3195054982-4292022746-1467505928-1000\{AE2A7770-DB0D-4C25-B45F-EBC2682B52FF}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 786446.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4572	taskmgr.exe
Token: SeSystemProfilePrivilege	4572	taskmgr.exe
Token: SeCreateGlobalPrivilege	4572	taskmgr.exe
Token: 33	4572	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4572	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe
4572	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4896	4592	WScript.exe	98
PID 4592 wrote to memory of 4896	4592	WScript.exe	98
PID 1032 wrote to memory of 2488	1032	WScript.exe	100
PID 1032 wrote to memory of 2488	1032	WScript.exe	100
PID 1988 wrote to memory of 3244	1988	WScript.exe	102
PID 1988 wrote to memory of 3244	1988	WScript.exe	102
PID 1856 wrote to memory of 4792	1856	WScript.exe	105
PID 1856 wrote to memory of 4792	1856	WScript.exe	105
PID 1776 wrote to memory of 544	1776	WScript.exe	107
PID 1776 wrote to memory of 544	1776	WScript.exe	107
PID 4368 wrote to memory of 4548	4368	WScript.exe	108
PID 4368 wrote to memory of 4548	4368	WScript.exe	108
PID 5068 wrote to memory of 3024	5068	WScript.exe	110
PID 5068 wrote to memory of 3024	5068	WScript.exe	110
PID 2872 wrote to memory of 5060	2872	WScript.exe	111
PID 2872 wrote to memory of 5060	2872	WScript.exe	111
PID 4392 wrote to memory of 2840	4392	WScript.exe	115
PID 4392 wrote to memory of 2840	4392	WScript.exe	115
PID 4156 wrote to memory of 3384	4156	WScript.exe	116
PID 4156 wrote to memory of 3384	4156	WScript.exe	116
PID 3776 wrote to memory of 4348	3776	WScript.exe	120
PID 3776 wrote to memory of 4348	3776	WScript.exe	120
PID 4204 wrote to memory of 2784	4204	msedge.exe	128
PID 4204 wrote to memory of 2784	4204	msedge.exe	128
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129
PID 4204 wrote to memory of 4712	4204	msedge.exe	129

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wpp.vbs"
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:5052

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops startup file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4572

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2432

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs
1⤵
PID:4248

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\wpp.vbs"
  2⤵
  PID:4896

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\wpp.vbs"
  2⤵
  PID:2488

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\wpp.vbs"
  2⤵
  PID:3244

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\wpp.vbs"
  2⤵
  PID:4792

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\wpp.vbs"
  2⤵
  PID:544

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\wpp.vbs"
  2⤵
  PID:4548

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\wpp.vbs"
  2⤵
  PID:3024

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\wpp.vbs"
  2⤵
  PID:5060

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs"
1⤵
- Adds Run key to start application
PID:336
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\wpp.vbs"
  2⤵
  PID:2308

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\wpp.vbs"
  2⤵
  PID:2840

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\wpp.vbs"
  2⤵
  PID:3384

C:\Windows\System32\kwrgi5.exe
"C:\Windows\System32\kwrgi5.exe"
1⤵
PID:1960

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\wpp.vbs"
  2⤵
  PID:4348

C:\Windows\sysmon.exe
"C:\Windows\sysmon.exe"
1⤵
PID:4624

C:\Windows\sysmon.exe
"C:\Windows\sysmon.exe"
1⤵
PID:4868

C:\Windows\sysmon.exe
"C:\Windows\sysmon.exe"
1⤵
PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8b95146f8,0x7ff8b9514708,0x7ff8b9514718
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8020 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7608 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7696 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7660 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7728 /prefetch:1
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8732 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8256 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3864 /prefetch:8
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2012,14030962151749652260,6376156173682794415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3952 /prefetch:8
  2⤵
  PID:2916
- C:\Users\Admin\Downloads\HitmanPro_x64.exe
  "C:\Users\Admin\Downloads\HitmanPro_x64.exe"
  2⤵
  - Executes dropped EXE
  PID:5776
- - C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe" /update:"C:\Users\Admin\Downloads\HitmanPro_x64.exe"
    3⤵
    - Executes dropped EXE
    PID:5312
  - - C:\Users\Admin\Downloads\HitmanPro_x64.exe
      "C:\Users\Admin\Downloads\HitmanPro_x64.exe" /updated:"C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:4660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1320

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4bc 0x3cc
1⤵
PID:1980

C:\Program Files\HitmanPro\hmpsched.exe
"C:\Program Files\HitmanPro\hmpsched.exe"
1⤵
- Executes dropped EXE
PID:5884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\HitmanPro\hmpsched.exe

Filesize
149KB

MD5
8fff29a372f3fead0475c4fc4ecfbc4a

SHA1
24b8b770b9f3c400333a9622e352f545568f931a

SHA256
8768ec067d72aa5a7dd2a06cf3128022d44366d8b19cd9e12d44b96cc3984eaa

SHA512
4485323d3bf2d7875c3f53ccc3079104491bfb31b1035abda7678fb2c2ea46a4b7718d3d4dbb819cd789634296470d37cfac1e259be20ffcaa2a318e806d3c65

Download Submit
C:\Program Files\HitmanPro\hmpsched.exe

Filesize
149KB

MD5
8fff29a372f3fead0475c4fc4ecfbc4a

SHA1
24b8b770b9f3c400333a9622e352f545568f931a

SHA256
8768ec067d72aa5a7dd2a06cf3128022d44366d8b19cd9e12d44b96cc3984eaa

SHA512
4485323d3bf2d7875c3f53ccc3079104491bfb31b1035abda7678fb2c2ea46a4b7718d3d4dbb819cd789634296470d37cfac1e259be20ffcaa2a318e806d3c65

Download Submit
C:\ProgramData\HitmanPro\Customize.bin

Filesize
336B

MD5
65d3b30ed19dcc7249778e27c27df44f

SHA1
69510d1075901c23424b2fab290001db7e4b1dde

SHA256
f63d8e9b065ac023d7e5ab551f5e6a68578a01a21c57efe382066796e9ad15de

SHA512
69d127c5329f63c8ccea423cd2cfd80a6990ad77b5661b6734568595f2f3f73f6348f12232859f2b00c36682923e9505dc214d1f97c7589067352c3ae22c7baa

Download Submit
C:\ProgramData\HitmanPro\Splash.bin

Filesize
38KB

MD5
c12f79e4b00a1761a06102ff74a36fa5

SHA1
020fc3af02e45556b6be8aacc0682beaeb748b48

SHA256
e8d8cf8fa82da24e23685d77c68124f5358d8789faa068eaa4e5ecd37b492939

SHA512
456ddba7b6fa3e11bf9f94d21c2d7dbeb1b9bc0f85246124d2b0cc505d3427c06f77180054ef7d72856ff3a0d80238547bb91affcd6810ad4f069d5e88677bc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
471B

MD5
e1d0c4cfeaba64c4b16f9c276f05ad35

SHA1
0e8474f7437e2772124794e617853c90c16bd259

SHA256
2df38eac896cc39f1cc9a9f29db92532fcb72cc7207a04e881baa135ad9740bc

SHA512
ef7b3304b5f60f790893babc931e937c10c998e12da8d66c7e604cb0950cfaa4e9c3be2200f94b0a9fe84e4946cd9953ab6a25f0bd910d062a458e96906062f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_50A69C20906A5D39CF9E2D57B0028374

Filesize
471B

MD5
8be98929ec460929ebdd904a77e6f48f

SHA1
2c009ae5df6a31bec2cdb4357924e923329e6b3c

SHA256
37ee661af0c3817eecdfe8e5d5d455118bceb6dc09097bdc9f14c0b6f3f45d03

SHA512
41800734c232ca92f94c07e129971ab503adef478a15884825bd5fdc352b13ee47bb0a512f79b1b790b45b3296d9840f5eb98bf09a8e4bceb424b4a33380ed13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5

Filesize
404B

MD5
420e5405f154452119ca14d66216e7c6

SHA1
83048341ae41a62b938675f8bbfa1cd097ab06cc

SHA256
8e38f25e3a4b92bf7bff27b79d8c63ae7ff602d51b4fdfd2d083ac767aeaf5f8

SHA512
17a7cdd7d893782b393e8fd10824de19cfda276fcc8c1a6db4da30dfb41f78f8cd6e755dddf4bb57a47fb2624c371cbc5cdaa61872718a134a31ff3fb8d812dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_50A69C20906A5D39CF9E2D57B0028374

Filesize
400B

MD5
fbe24e4471d0598ed53c3c83e53dfd34

SHA1
0e9853eb80b7b3943bf41556d938d661e1ea7f68

SHA256
e139b0f7944da22ba78198c73c4907a60c3777a92cb778bbedebadcdc297b0fb

SHA512
c2078b7d70e12af69a467efff7fa637d0758eb545c2e3c39767da0c1c08444774dd97fcd82973571daa2e025801c7781b317eebb27cdd71984a576f07b298691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3423d7e71b832850019e032730997f69

SHA1
bbc91ba3960fb8f7f2d5a190e6585010675d9061

SHA256
53770e40359b9738d8898520d7e4a57c28498edddbadf76ec4a599837aa0c649

SHA512
03d5fee4152300d6c5e9f72c059955c944c7e6d207e433e9fdd693639e63ea699a01696d7bbf56d2033fd52ad260c9ae36a2c5c888112d81bf7e04a3f273e65d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000052

Filesize
10.8MB

MD5
15ce40375f3951fa5dfff11a92428cf3

SHA1
f3d8cf9dd58501611ceb57e46103551a231a1b6d

SHA256
78a6356b1d600b8a9517f82bdd78b8c505f80ef6f395fd186e9937a4bea2db14

SHA512
03ef6fb2c8a2a94b5a9dde7bc1cd6417a6bd77aef35124ffc60d6a41d280a0f984bb48cf7741b6d4f485e6b31969765c39018bee19f5c0be9a8033bf1e690d70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
b4ebde37556dab2d61cfbad3f7036a51

SHA1
db9a9604692fc47718b94ecb35eea6e48053a331

SHA256
ecd335137c947f1b603eccafb740bc2893f003c444cee409acf4ce1b83a6d634

SHA512
a492a017f103d8524ca1cbc4fae88663fa2f3bb4fd29d59dfc7bbc81559e9a260bd8ce98b8e70aad777892c941420191d7d0f1ad5d054ee2f12449ba7274a405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
13KB

MD5
4a8b68efbbcdb2b9f26f0c7d408e9b01

SHA1
4b0fb9cfc63a93b40c2e88e2d7063018c0ab2ba7

SHA256
791f07f8cfed15b92294bf4ef24e6c092da5569248dfb4160374416e7586d2f3

SHA512
4e70dc13a7aca1c322e075bfbcc092ad019ab84f40ec79e4579f2ea22ab9051a1a7dac623f76aa84acb25b98bd5b4e67672eabcfef1d8c11f640231860de1ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cdcc613a525c1b59bb52ac31ae6421b2

SHA1
f27acef2319c24ff0fdec47b41e5fc7064676138

SHA256
1e65f4b95cbbe1e182814d0c50a67d9d94cba51448f45d5d18ae1f9e908bae0c

SHA512
51d9c8a940378d65c883682bcab09f291a8dd83e4c14c9669aa2bb043219d9b206d8ab22da303205274ab2edd257540a0b734ff3f42387c96e4d3890a27d4145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
72bdb6e9e1f69be3a25d9ad048fd6642

SHA1
6386513ff2bf03946bfce2d4a7dd15959ab49c88

SHA256
d2a16053ec6bdb49c5a47fbe57ed0e7273d6f4b3cf71f87fdac8c6272df1ab56

SHA512
b4f8d7af4e2984d6acc8934f0b02647cd468243c7281d89d7350785d0f6de09b1b2264b401b22761dc7cb8c200b11d6e9ff7f15a87d7b636654977c377be7149

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
a3640c7d2daa6fd6524e55562d84ea63

SHA1
b88131aaacb758c0000e4d2bafdb3995748365da

SHA256
2ed4fb9486b8dad8616178f766d8a906dcbac02c5194f12e7673eb11e01005e9

SHA512
1e094185e5e6a7e4c0fdd8523a2e40178e56d98e106401f443eaecfaaf5df24069ab30e909e3ee20a150668cd7ac0d2317b785e7e34cc6e122678e17eb8ece30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
563d3e11e3ff95c3e887f18c58402c41

SHA1
675a2f0292d42a83312c4ab7ba654b2585c4551e

SHA256
6619d4b398b71aabd82b8580bc9ee4193237f42afdb9c2d9fba8b692e4526e88

SHA512
0bdae4f97a7e8496786964601eadc407e6ee76d8e95c6b0e3dee38defa7488394a5a76e10dc250327f92164198e805099a67bc5df5cd991d46a3b182096095f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d913bfdb22926170792e5fec879b4056

SHA1
9495db0525d8bbe902a1e6a07f485ad95c155650

SHA256
8dea1574b6fa166795e2e3525ae9533ab8d77070856d9d18a58261cb5c0287a4

SHA512
3f1fe89fb185ba7b4bb839525e3431697b56d60c0ba525f0dad4ee340f3a525ef4a3c149390adf7c28e4293d96b748079c8bf7a5791f5f406569019febe8cf94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0e78f9a3ece93ae9434c64ea2bff51dc

SHA1
a0e4c75fe32417fe2df705987df5817326e1b3b9

SHA256
5c8ce4455f2a3e5f36f30e7100f85bdd5e44336a8312278769f89f68b8d60e68

SHA512
9d1686f0b38e3326ad036c8b218b61428204910f586dccf8b62ecbed09190f7664a719a89a6fbc0ecb429aecf5dd0ec06de44be3a1510369e427bde0626fd51d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3140fec5911011e67fceede553e4f1ea

SHA1
27087250fae781681ca269e709338305cf68454b

SHA256
ad954407a2fc242d8d465d23d9c59f7b14505ab413a1c67685d5f8390ad0898c

SHA512
9f3a74731d083398cf1bb342356f8d93ca67d4771c59883abe5a9066c47eda2558f17d8240adad21dbd143b5c7a1df38f1dcd879b58e8f8ebe32e749bfe1b915

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59484a.TMP

Filesize
3KB

MD5
504f9cef85968913424664a2e75fa044

SHA1
8329a5cd8a265cddeb6c367d39f619509f8a6cbb

SHA256
fa6ec5e12fb1b3c35b94f090be5a71dd936697721947df60ad20319ce898e1df

SHA512
56ec4f9f308a32dee443a2f0c01a3fa0a2e29363cd7cb077bedb17509f1bb1d2f11b653fb0a11aa012a4451db822d32a7f6eeb0e6cbbc2690ec3bdda9b466bf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c98981e366d6964ef98abf4cf7ca9627

SHA1
7fef78527af8e4d812e5e2715b6a997756a59c8c

SHA256
c3fbf15cea2267bd9bc9dbd0c14476124aa2222d50118f5e3adbb7da1c94c04c

SHA512
233ba1020c7a87c741d8d85be67ac69f15b13af87640e5c7d389623ad4d8846cbae05ee65faf6741a5c331f3e1349670a44b89ab82073a2ba669499c440bd62c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b523c1c50a261f18f330011504cc3d9d

SHA1
fda018cb0cc8579e73d14acf780c8310de606201

SHA256
693906f64aab70afb063d2f9e3a2c0a11981abf2942b84bd63f4c1bf4c862e04

SHA512
6e6ab3b6823ff30ce0da84c4146e82e0facdbdb758975c9dff7080bace57fad4b3d2ad8f26f7b6626de3d617394700fe6205870597c010c4d39789daa3915415

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c229b6280fdaf6019d83f567c64c65db

SHA1
ee8b516098fb9366a1a2f0b3dbd815ee5efce299

SHA256
afb9eba1fc472d341c89a2d2ab613cad512292dd30d8ede41f1423493d5166b4

SHA512
3485f3826b2a999142573feaecb8222d6aefb6dc7b601f98571e4dde2905c90a80b67189a2ed409feeb9241d1e8b10d97dcbbb26e4eb59a911137cfab38dff46

Download Submit
C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe

Filesize
13.6MB

MD5
15e710b146c623f60cfa3e1b516b640e

SHA1
cc00f20fa520b3c5ea3bade44cd77e642a607150

SHA256
94f068bda39698e454f3cd8905be87d1c761ca55c4a5f7c59f71a55861ed0d9e

SHA512
3c5bcccf2a3442713007bd9fc1a78ec16ba80a96a97b47eb765d1a96a90ee3f792a6778a975644ca9a042142a7beff9cf01d97e1a9a68664f395c04eedeccbfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe

Filesize
13.6MB

MD5
15e710b146c623f60cfa3e1b516b640e

SHA1
cc00f20fa520b3c5ea3bade44cd77e642a607150

SHA256
94f068bda39698e454f3cd8905be87d1c761ca55c4a5f7c59f71a55861ed0d9e

SHA512
3c5bcccf2a3442713007bd9fc1a78ec16ba80a96a97b47eb765d1a96a90ee3f792a6778a975644ca9a042142a7beff9cf01d97e1a9a68664f395c04eedeccbfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\HitmanPro_x64.exe

Filesize
13.6MB

MD5
15e710b146c623f60cfa3e1b516b640e

SHA1
cc00f20fa520b3c5ea3bade44cd77e642a607150

SHA256
94f068bda39698e454f3cd8905be87d1c761ca55c4a5f7c59f71a55861ed0d9e

SHA512
3c5bcccf2a3442713007bd9fc1a78ec16ba80a96a97b47eb765d1a96a90ee3f792a6778a975644ca9a042142a7beff9cf01d97e1a9a68664f395c04eedeccbfc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wpp.vbs

Filesize
257KB

MD5
d87d4c42c10f332a96aa10ffb455f49d

SHA1
c6167ce4e59f14ce826a50e8d32847101e5e9dc8

SHA256
5ad4d5fb75a277e31b05e1a6f19c5fc3c007b5c2be03109d876ca457173a135a

SHA512
d01c7072b7f9e85dbc8f160f0afc17116a5ec5039a1f07a9201d517d8029acc8f31b446ccd66f832eb5ea58c3e88db88b2e442c7965e0318af32852512c3aa8a

Download Submit
C:\Users\Admin\Downloads\HitmanPro_x64.exe

Filesize
13.6MB

MD5
15e710b146c623f60cfa3e1b516b640e

SHA1
cc00f20fa520b3c5ea3bade44cd77e642a607150

SHA256
94f068bda39698e454f3cd8905be87d1c761ca55c4a5f7c59f71a55861ed0d9e

SHA512
3c5bcccf2a3442713007bd9fc1a78ec16ba80a96a97b47eb765d1a96a90ee3f792a6778a975644ca9a042142a7beff9cf01d97e1a9a68664f395c04eedeccbfc

Download Submit
C:\Users\Admin\Downloads\HitmanPro_x64.exe

Filesize
13.6MB

MD5
15e710b146c623f60cfa3e1b516b640e

SHA1
cc00f20fa520b3c5ea3bade44cd77e642a607150

SHA256
94f068bda39698e454f3cd8905be87d1c761ca55c4a5f7c59f71a55861ed0d9e

SHA512
3c5bcccf2a3442713007bd9fc1a78ec16ba80a96a97b47eb765d1a96a90ee3f792a6778a975644ca9a042142a7beff9cf01d97e1a9a68664f395c04eedeccbfc

Download Submit
C:\Users\Admin\Downloads\HitmanPro_x64.exe

Filesize
10.8MB

MD5
15ce40375f3951fa5dfff11a92428cf3

SHA1
f3d8cf9dd58501611ceb57e46103551a231a1b6d

SHA256
78a6356b1d600b8a9517f82bdd78b8c505f80ef6f395fd186e9937a4bea2db14

SHA512
03ef6fb2c8a2a94b5a9dde7bc1cd6417a6bd77aef35124ffc60d6a41d280a0f984bb48cf7741b6d4f485e6b31969765c39018bee19f5c0be9a8033bf1e690d70

Download Submit
C:\Users\Admin\Downloads\HitmanPro_x64.exe

Filesize
10.8MB

MD5
15ce40375f3951fa5dfff11a92428cf3

SHA1
f3d8cf9dd58501611ceb57e46103551a231a1b6d

SHA256
78a6356b1d600b8a9517f82bdd78b8c505f80ef6f395fd186e9937a4bea2db14

SHA512
03ef6fb2c8a2a94b5a9dde7bc1cd6417a6bd77aef35124ffc60d6a41d280a0f984bb48cf7741b6d4f485e6b31969765c39018bee19f5c0be9a8033bf1e690d70

Download Submit
memory/4572-143-0x000002190CD90000-0x000002190CD91000-memory.dmp

Filesize
4KB

Download
memory/4572-144-0x000002190CD90000-0x000002190CD91000-memory.dmp

Filesize
4KB

Download
memory/4572-146-0x000002190CD90000-0x000002190CD91000-memory.dmp

Filesize
4KB

Download
memory/4572-145-0x000002190CD90000-0x000002190CD91000-memory.dmp

Filesize
4KB

Download
memory/4572-147-0x000002190CD90000-0x000002190CD91000-memory.dmp

Filesize
4KB

Download
memory/4572-135-0x000002190CD90000-0x000002190CD91000-memory.dmp

Filesize
4KB

Download
memory/4572-142-0x000002190CD90000-0x000002190CD91000-memory.dmp

Filesize
4KB

Download
memory/4572-141-0x000002190CD90000-0x000002190CD91000-memory.dmp

Filesize
4KB

Download
memory/4572-137-0x000002190CD90000-0x000002190CD91000-memory.dmp

Filesize
4KB

Download
memory/4572-136-0x000002190CD90000-0x000002190CD91000-memory.dmp

Filesize
4KB

Download