hxxps://github[.]com/pankoza2-pl/kapi2[.]0peys-malwares

Analysis

max time kernel
375s
max time network
703s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2023, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/pankoza2-pl/kapi2.0peys-malwares

Score

8^/10

bootkit evasion persistence

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	EternalBlue.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	Laplace.exe

Executes dropped EXE 1 IoCs

pid	Process
3952	Laplace.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Laplace.exe
File opened for modification	\??\PhysicalDrive0	EternalBlue.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\compmgmt.msc	mmc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\RecoveryDrive\setupact.log	RecoveryDrive.exe
File opened for modification	C:\Windows\Logs\RecoveryDrive\setuperr.log	RecoveryDrive.exe
File opened for modification	C:\Windows\Logs\RecoveryDrive\diagerr.xml	RecoveryDrive.exe
File opened for modification	C:\Windows\Logs\RecoveryDrive\diagwrn.xml	RecoveryDrive.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133410905948370836"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	CompMgmtLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	EternalBlue.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	CompMgmtLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "3"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	Laplace.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
3952	Laplace.exe
3952	Laplace.exe
3952	Laplace.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
3852	msedge.exe
3852	msedge.exe
2280	msedge.exe
2280	msedge.exe
3952	Laplace.exe
3952	Laplace.exe
3952	Laplace.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
3952	Laplace.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
3952	Laplace.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
5920	msedge.exe
5920	msedge.exe
1784	identity_helper.exe
1784	identity_helper.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
3952	Laplace.exe
3952	Laplace.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
3952	Laplace.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
3952	Laplace.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
3952	Laplace.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
3952	Laplace.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
3952	Laplace.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe
Token: SeShutdownPrivilege	2112	chrome.exe
Token: SeCreatePagefilePrivilege	2112	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
3952	Laplace.exe
2504	EternalBlue.exe
3952	Laplace.exe
3952	Laplace.exe
2504	EternalBlue.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe
3852	msedge.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3952	Laplace.exe
3952	Laplace.exe
3652	OpenWith.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe
2504	EternalBlue.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1484	2112	chrome.exe	74
PID 2112 wrote to memory of 1484	2112	chrome.exe	74
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 2344	2112	chrome.exe	85
PID 2112 wrote to memory of 4448	2112	chrome.exe	86
PID 2112 wrote to memory of 4448	2112	chrome.exe	86
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87
PID 2112 wrote to memory of 1312	2112	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/pankoza2-pl/kapi2.0peys-malwares
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa778e9758,0x7ffa778e9768,0x7ffa778e9778
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:2
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:1
  2⤵
  PID:620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:8
  2⤵
  PID:416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4860 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4756 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:8
  2⤵
  PID:60
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5840 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5804 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5604 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5396 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:8
  2⤵
  PID:4492
- C:\Users\Admin\Downloads\Laplace.exe
  "C:\Users\Admin\Downloads\Laplace.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wsgjfwhxkkbhcv1stylv0tallpeqxeozoxk7.us/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa74bf46f8,0x7ffa74bf4708,0x7ffa74bf4718
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
      4⤵
      PID:1564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
      4⤵
      PID:636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
      4⤵
      PID:388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4052 /prefetch:8
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2360 /prefetch:1
      4⤵
      PID:404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4684 /prefetch:8
      4⤵
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 /prefetch:8
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1772 /prefetch:1
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
      4⤵
      PID:4032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:1
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
      4⤵
      PID:6360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
      4⤵
      PID:6460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
      4⤵
      PID:6688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,2729422461488920232,12380808439214154201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:6376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://2gpj7mudgsm3agr3w9yiwbdhr.edu/
    3⤵
    PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0x100,0x138,0x7ffa74bf46f8,0x7ffa74bf4708,0x7ffa74bf4718
      4⤵
      PID:5408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wfc3w108hugabcpwebhna7xiq.us/
    3⤵
    PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffa74bf46f8,0x7ffa74bf4708,0x7ffa74bf4718
      4⤵
      PID:1780
- - C:\Windows\System32\SgrmBroker.exe
    "C:\Windows\System32\SgrmBroker.exe"
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://k7ifroruyoo1m1yzfetcn6fpkkhqkgffctbggez53saq3xo.org/
    3⤵
    PID:2200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0x120,0x124,0x104,0x128,0x7ffa74bf46f8,0x7ffa74bf4708,0x7ffa74bf4718
      4⤵
      PID:5796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mkzrvgz3bdn9qamxm8gnx8cq5qlo5.biz/
    3⤵
    PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa74bf46f8,0x7ffa74bf4708,0x7ffa74bf4718
      4⤵
      PID:1168
- - C:\Windows\System32\printfilterpipelinesvc.exe
    "C:\Windows\System32\printfilterpipelinesvc.exe"
    3⤵
    PID:5192
- - C:\Windows\System32\NetEvtFwdr.exe
    "C:\Windows\System32\NetEvtFwdr.exe"
    3⤵
    PID:528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aqsyd9qho7alekwxnwqkmq1ssfido17hzv.com/
    3⤵
    PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x11c,0xf8,0x7ffa74bf46f8,0x7ffa74bf4708,0x7ffa74bf4718
      4⤵
      PID:5656
- - C:\Windows\System32\netcfg.exe
    "C:\Windows\System32\netcfg.exe"
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://chcjxxo128pfgvoic3ezrdjbmp.cc/
    3⤵
    PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa74bf46f8,0x7ffa74bf4708,0x7ffa74bf4718
      4⤵
      PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://53aog6xcdftvwtun9srrnczeu0kiorjdnydksxspxas6.gov/
    3⤵
    PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0xf8,0x7ffa74bf46f8,0x7ffa74bf4708,0x7ffa74bf4718
      4⤵
      PID:6072
- - C:\Windows\System32\DevicePairingWizard.exe
    "C:\Windows\System32\DevicePairingWizard.exe"
    3⤵
    PID:1068
- - C:\Windows\System32\control.exe
    "C:\Windows\System32\control.exe" "C:\Windows\System32\hdwwiz.cpl",
    3⤵
    PID:6540
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\hdwwiz.cpl",
      4⤵
      PID:6668
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc
        5⤵
        
        PID:6700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://2lbfr3koo29whk1nnuhw3ofig6a34r.edu/
    3⤵
    PID:6760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa74bf46f8,0x7ffa74bf4708,0x7ffa74bf4718
      4⤵
      PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bjyzv24.cc/
    3⤵
    PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa74bf46f8,0x7ffa74bf4708,0x7ffa74bf4718
      4⤵
      PID:7020
- - C:\Windows\System32\PATHPING.EXE
    "C:\Windows\System32\PATHPING.EXE"
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t17f5xniasawqtw9kqxbwm6vmoga1sikl84kvccvwzv.ws/
    3⤵
    PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa74bf46f8,0x7ffa74bf4708,0x7ffa74bf4718
      4⤵
      PID:6208
- - C:\Windows\System32\bitsadmin.exe
    "C:\Windows\System32\bitsadmin.exe"
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://zku2sitgkpxgbzl2zvmflis0ejgmf.cc/
    3⤵
    PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa74bf46f8,0x7ffa74bf4708,0x7ffa74bf4718
      4⤵
      PID:6156
- - C:\Windows\System32\AxInstUI.exe
    "C:\Windows\System32\AxInstUI.exe"
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://vpx7vay6uuam.us/
    3⤵
    PID:6932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa74bf46f8,0x7ffa74bf4708,0x7ffa74bf4718
      4⤵
      PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2788 --field-trial-handle=1904,i,3577239073239294245,16729835578013687587,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4332

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1104

C:\Users\Admin\Downloads\EternalBlue.exe-by-kapi2.0peys-main\EternalBlue.exe-by-kapi2.0peys-main\EternalBlue.exe
"C:\Users\Admin\Downloads\EternalBlue.exe-by-kapi2.0peys-main\EternalBlue.exe-by-kapi2.0peys-main\EternalBlue.exe"
1⤵
- Disables RegEdit via registry modification
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2504
- C:\Windows\System32\TSTheme.exe
  "C:\Windows\System32\TSTheme.exe"
  2⤵
  PID:3748
- C:\Windows\System32\CompMgmtLauncher.exe
  "C:\Windows\System32\CompMgmtLauncher.exe"
  2⤵
  - Modifies registry class
  PID:6008
- - C:\Windows\system32\mmc.exe
    "C:\Windows\system32\mmc.exe" "C:\Windows\system32\compmgmt.msc" /s
    3⤵
    - Drops file in System32 directory
    PID:4136
- C:\Windows\System32\verifier.exe
  "C:\Windows\System32\verifier.exe"
  2⤵
  PID:4796
- - C:\Windows\system32\verifiergui.exe
    "C:\Windows\system32\verifiergui.exe"
    3⤵
    PID:3640
- C:\Windows\System32\DisplaySwitch.exe
  "C:\Windows\System32\DisplaySwitch.exe"
  2⤵
  PID:5708
- C:\Windows\System32\tar.exe
  "C:\Windows\System32\tar.exe"
  2⤵
  PID:5912
- C:\Windows\System32\raserver.exe
  "C:\Windows\System32\raserver.exe"
  2⤵
  PID:1796
- C:\Windows\System32\DeviceEnroller.exe
  "C:\Windows\System32\DeviceEnroller.exe"
  2⤵
  PID:1420
- C:\Windows\System32\RecoveryDrive.exe
  "C:\Windows\System32\RecoveryDrive.exe"
  2⤵
  - Drops file in Windows directory
  PID:5708
- C:\Windows\System32\services.exe
  "C:\Windows\System32\services.exe"
  2⤵
  PID:5516
- C:\Windows\System32\msinfo32.exe
  "C:\Windows\System32\msinfo32.exe"
  2⤵
  PID:5728
- C:\Windows\System32\securekernel.exe
  "C:\Windows\System32\securekernel.exe"
  2⤵
  PID:6684
- C:\Windows\System32\DFDWiz.exe
  "C:\Windows\System32\DFDWiz.exe"
  2⤵
  PID:6096
- C:\Windows\System32\comp.exe
  "C:\Windows\System32\comp.exe"
  2⤵
  PID:4444
- C:\Windows\System32\sessionmsg.exe
  "C:\Windows\System32\sessionmsg.exe"
  2⤵
  PID:2588
- C:\Windows\System32\sdclt.exe
  "C:\Windows\System32\sdclt.exe"
  2⤵
  PID:2808
- - C:\Windows\System32\control.exe
    "C:\Windows\System32\control.exe" /name Microsoft.BackupAndRestoreCenter
    3⤵
    PID:1420
- C:\Windows\System32\compact.exe
  "C:\Windows\System32\compact.exe"
  2⤵
  PID:4036

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3652

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410 0x3fc
1⤵
PID:1072

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:2304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5648

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:5232

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:2268

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
PID:2276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:3916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicePickerUserSvc
1⤵
PID:3384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:1104

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:6092
- C:\Windows\system32\dashost.exe
  dashost.exe {0746f53d-56d4-458f-95f88524b7824773}
  2⤵
  PID:4484
- C:\Windows\system32\dashost.exe
  dashost.exe {903371a0-d6c0-4a20-9660934eb076f37b}
  2⤵
  PID:5740
- C:\Windows\system32\dashost.exe
  dashost.exe {78d88e9f-c164-4935-8d806504d780be41}
  2⤵
  PID:4564

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1668

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2400

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6132

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
41KB

MD5
aa1551cd8db18dbe5975e468a533f116

SHA1
1f8f5e8fa9c4dd50d75c8b99750c74724d97faca

SHA256
d0d52b94ccd0e914846c898e17a11b97058bff0f7fda06538566d897da183074

SHA512
acae022bf8b157cea16a76e5355b3cf281db3fc3826d3e6bdd11abda12c7cfa92ea6ff98350fb613bc7f17b0cdd03fa804abdefc113dd7d072ed80083416ce0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
32KB

MD5
8aadc0e6eed91ee992a049b460935282

SHA1
cbc65b36a47651530bdf5ca408429cbcac96ceb0

SHA256
61e5b0bda341524b491e36fab581d0315b11dfd7e88c03681bcc5b69129f68b9

SHA512
e5df6fc3e80ea1acada4f5478f0abf5eee89efc4aa99b5b23bdedd0e2eca959883b0e8ca9be803dc40039139021f9d39aeb54ea6e9cf7f41098126e2c3a3145e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
44KB

MD5
3eb563ce8caf946ae2b552408aed857a

SHA1
9783bfb1195e1b3aaf168e577c25c604bbce1fd3

SHA256
817de74b5ac792b0f2b9db31930e47a98c7cff6d8a08d30ad25f29d208853ab6

SHA512
db225ddfabe8d1f63892d661426d3e89291433349652fb4352557b4e7df042b4c9d48715864b595734396aaa46a8ade1fab7cca115ef131c556941226a7f5ad4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a

Filesize
24KB

MD5
1245755364039130549d29a3d580083d

SHA1
7cb37f4748202ea9f12877a28909b7aa5bcfc4ae

SHA256
550154f095d7b50604d267196bd6da88c0b7d2217b387c121edf266a3597a377

SHA512
d0d81f78da1fb2cbb13e3c341f54b5a278958a8e0bdc90a6943c1a4e80e73770b779ddc3acc390122218aa902cd0313507da8c41c769506c27cd319a720645d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

Filesize
19KB

MD5
5d9b7eb68768481a0989ded4eef2fa49

SHA1
e0371a48813b1f842a5ace827793df3f916cd012

SHA256
bb568d46fcfc0636f69ebc72f5faa6034f896a668f1bf5c10be2e21bb93cbd0e

SHA512
9c22a5ab50c6ff354031af843a6d7ea184d84367cba3b0422420099764cf6b2904dfa775522aa3d86808ac9d52b47d8c13d2cd4cc9cc4d96e69167b63ba184a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

Filesize
62KB

MD5
8a2e850685b8a72f1207f7e3c9fa6ece

SHA1
324c7149888313cfce0d243a553894f0cc207d86

SHA256
9bbbdbcd226cd61951c1c96a4f51159d8009cd08f16670328f07d9f5ee93968e

SHA512
0feb2621428e5cdafcfbc626a01f4deb080189734c4022e572412b5290544d517958c62935902bf366c6f59cab9dc16b88122b1cb81ecc602567d15132e0b982

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

Filesize
21KB

MD5
f6ff27e1d80b842810a8ce9a58f21f5e

SHA1
d0aecdd80c7487129a4bbe3b08cc2e197fbccaa3

SHA256
4fc4718f3ab6f6b0c1843f12fd36577acfaaa11354a70f1df7deafa03de402f0

SHA512
2e99712808854240a606050b31aeae89bfa13e6b5806ee862696aaebffc4f27ce3672a848aac3c7c2efbfcabe8bbb529cf553e47ef7ff88bbce3f4235185b29b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
31949caa408cc03d88410358997595b8

SHA1
a26104411032c8c68c392992918dbc7e9d19e327

SHA256
743ff6ac13c5c1b33ae8ca07ce3f60a15875520f1d36d35ca2a506ba2fefbe38

SHA512
25e9c4dc90bc3bde423740f3bb2992f0d65d4d65aa891093690187ad79ea158a3e3c9ba2bbd31bfdcd94013d13d8c7961d9135469355a53ec90af526d9b8bb90

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
dd37b6b4cb3506f1b430bd1cc5c7df1e

SHA1
02dcc62dc491498fc60d1026529d79cd2cd42893

SHA256
e2e461b3a437022a67502bcafde56af6c401f03d151430d0d48bc87ba7c5d75b

SHA512
aa06817a137251beb241125f700287a9ff93eea944a2ff11d9c14d6ac4f7c3b03cf91693abc5d09b49c12a168950e6ed4f030cb9fa18a3feadd7c48fad9dd405

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
42bbc6e70c00b46906acdb09c5a305eb

SHA1
f15e90cb385c0d4d64e92c1ea95bd991aae5a57c

SHA256
cf0008880670e8670925950fc30732f6b38c82de0ec5bef53625f94556efaaa2

SHA512
640181e3e6b371cf62f49fcf07771b643b3f593b9b5165c6ba08b889028fced911c2a8ef912d88ab91eba2163da8c0fd2fc099fece27957807678d02de0d1f40

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
37f75b6a24b271a77226ececf7e26b78

SHA1
1610a87a36a67fab7eb2d8721d4d1bfa8a8ce2f8

SHA256
bb70895d7b2736b3d46d690a23ad4f2f89e1acf2c272a35167b17b70a32ccb46

SHA512
4e63dbf035d84b1f421731c78b6220bbf616fb5c2211512ae286884a67522c4681861b5c2754a7c8e7ad3db06b744e5e70427ce93af5977ace73aeb07cd445bf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
31f0609307c556e702956ff83e9fe8dd

SHA1
fc5c8aed26567359eb515c9a147a429e56b37679

SHA256
e26098f43ae2b65a8d34a4fc6adafaa1f1632f52f43ac50f9a4f0ef5871aee53

SHA512
82e280a2700a291316eb726b46df9e9e07f5ea24e36a1ae3610a091294924a82c35b42034367332c4239b2122af06eff2c111f63d2ad1bfdb50cff96d2b7d051

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
99423cf1ec1216b9061ccae089d0bf46

SHA1
45bc91c5d8dc5397ed0e35fb51132d93d6900886

SHA256
0a122c610b2b50276b136c37b28de2be38d83c86ad861b2addd5e263d193146a

SHA512
71e993b0841e03082dabfb9bd28225453d5f162651dd8e7603f297b5a1c06940d4aabff3cdd77eda7f494e96566aae6cd7a0bb58af413e64d3e4cd10c33b83bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
83969801585037cc0d740cab96981ebc

SHA1
2eb9a30030e157eae0b35ca137f828ee9590fbea

SHA256
60c823fddcd37702b69a0a542f4cbcc7c58279e4f6a8b8ad150e63e7254c7000

SHA512
723c45728b2c06203e2a9586f36bbc981bd35f01d92f987cf95c653b81d5d032eecaafe55e5d4643d30c7325edf41557a38b3c6c5d10e8e9b39b9d25b84bb477

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
b8aeefaef05930561a5bbbf933f46191

SHA1
49ca674f890843dc30e36a20c871e3b96f87f029

SHA256
3afe7f1f231a616b789fee94879b4c2ae59163748c156588255961d06fc7fe51

SHA512
0a0d1b0129c7341afa9f4d038079833f691340b75a4123b872d39e02f734dc1f516a5982441e0b0b95dfa316a3cd14c785e321751f9a8944e8633a3611a29e17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ec1da151c4a086729e7050c6622b3fc3

SHA1
6475e2c65a3573f63cba79fabff665eb8db47827

SHA256
aaed819e5926746ddb357f6779305974ef3de4ee1de3d89041df5dc6b858520a

SHA512
f8f12768e6ca3b3b4a1673091888ff6b11aab2fc3c3ab7dd54dd1d01ed76d19d6f9c88d3ce20674fc27aab3a5937eca3586c6ad78a467742496877d00b8625a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
57328b46ea26b824ca3df80e0500c913

SHA1
d214638fc3cd7dfe90f28bb160550163261f2a54

SHA256
6c9f8a6c46a4698a2c50212ea26ac73ef89dda3aec4afc1e477afbbfd26c94ac

SHA512
689a0840e4d16b811143ebb9c1de829a41f55e98a117dc9a04c2842417bfed79532f888d5221ce068f74d2b049adf791e00a50a4a3be3f521333590648e07092

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
86397ba6c009401e2948a1fbf119b6ed

SHA1
3eab91fa1fbcdfa9ffc150651ad955daf6f244c2

SHA256
9539715b0eb8b713da55eb0469019e259d98e4d391fa299ac2493a90d9d94517

SHA512
731424a909ea79069f8b3dc4fd4516896103b72fee688b95f900d81e85ff62b318db32a7cfdb2c2bfb0a2c6ad4889e5958cfca5326baaf6c096b560045846756

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
186KB

MD5
f16c92a135624666ce0b89aa98eb1973

SHA1
311236940dedc0b88dba6abd49643bec060d4b90

SHA256
57ed2b157f9bfe21b0ad5ac53d5812d218de67d5fa272694385ec74b4fcf3207

SHA512
c00cb4841f43f48d32d1df956b3c2ffd67af6636be5a867e94e29fc0860aad4bc69314cddea5b614a2ea7c09e669bc6eb71c56fdcf107bc382d2a6a77f54a054

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
103KB

MD5
b73e12532ad8c3ce2596cec41a7abc9a

SHA1
0f468f7f0ad4cb6a374d247a917358ee80115cc5

SHA256
28c186b3e0c69d062d287decedf3702de1706cb76dd3bdc767c17fa9023b003e

SHA512
edf31fc9784953e8271765461c4ae1318b00d2b6607971710fdc6016b2ce14d5a0d796af959b20e1440a0579a9e8f94d445e613dcae41560a9d650998ded06b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
104KB

MD5
1ae377b9353cf4899e721cebf928e6a0

SHA1
a712fe00fa1ce85762e5557f4cf20b6a661d42d1

SHA256
7b25a633d3e2c38d821fe82aade418193eb1c9cbe98e4c895a8cc76b3e88993a

SHA512
32e912dcab3ee59c7a914bb7f69da94321f351eda7932a62aab969dc111845db917bc987f4c8559321b98148b01875db0e61dd3999f62a9dfa2f2bc7f7becf42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
185KB

MD5
504016859fb86ddea47d7454c962252a

SHA1
cde1abfabcda23351cfcc84f3de1191262ad4a74

SHA256
1ece65d5eeabd99e370b4539c1ca2b350ce43dc8869a55e56fdd2cc7073bbc13

SHA512
95b283809876ca47b8246e7b4d7f7fbde6f33bedb9819fce240cd12c9e126dced33fa252b294be99af6ff8cba2aed9bdaf872ca21d0ba1f53fc27b50091c9f33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
104KB

MD5
409b7336944c4a1ff9e1e9ac4ad2bdb1

SHA1
17c394ddba106c1616b58fbd951c6aa5e02381bb

SHA256
112010943e33f3d56c86de2e04c30a0a08d959e9d666daf1428beeaf1433497d

SHA512
ef3cf14e29e1ae0d7431b99d5fbffa2791deea49a5d37a42b2d79aa65f16697e21eee676fd0596bde5579638bd09f03ea55bbc1a88453de9cadcdb6712c00de2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
106KB

MD5
2cf1e169f407e2c8c48f9028d54fc2ab

SHA1
3a4488a5a3c12b3a7511a5ef69da6fac46d76d93

SHA256
7ddac0e82980e948d6dd02a78bfcb7d627d27146d7878038b8c401c8dd03cb31

SHA512
de6d8bfb1b54b0da99585b1eab41236103a747bbc815e83c57ba200243f2f75201be3ab2466e30db28dccc1352e859d57b218b0da79686cdfffcea0e893b82ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
111KB

MD5
b14889abd620a60c1b7a2df9fd8575a5

SHA1
8be0eb1ebeb238e73f211ad4de6ff33dfd4d586d

SHA256
3588db419b158a000c3e086b6bf4729aee93bb4781865c0125fee70daad9ab4c

SHA512
462ae8bc1ea0504f93a19e40ac1aefcba4f9b5b87724532cd7c30b85e04c8ce8fbbb6f6259acf3d2dc2e5f972624b4e758d286c038366aa96e8b1006b215a15b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe587819.TMP

Filesize
103KB

MD5
e53a968cf94f27adf68c44ad5a7a3c9a

SHA1
1b5978aee570a553f2df2c1c337109f918cc310f

SHA256
80eba0449dab30cd163c07ff494bb023078a07ee7905980d3056c44ca33e8f2e

SHA512
905f2d7850270c3d2b7572f3d8497c18f9c409c07658a8a8445f825f7793a9cc3fb2b01e840d65aa3abf7a1194e4000d21d63cdf0183085517694165c5072a11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d25fc6e43a16159ebfd161f28e16ef7

SHA1
49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4

SHA256
cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5

SHA512
ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c33f7297732d3711590ad5d6638468e1

SHA1
dac3e486ad2bac14540ff4d3fbc8dbfa581aa078

SHA256
fdf4f5034c971170611c77884804e82c0c6895525095733a45545588eea43983

SHA512
3cf50d5be04e8415213b25d199ca093905f1b28dced3a2e209818231ae324057a475b9d816e7b55040bb4c27cf5044e066ff614d924e8131a7b691a8ab000222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7b767ed5238edfd5bafd43ea805df0a4

SHA1
7c291935e3b82dc08a1b21816435beb5908322f2

SHA256
93ad7cbe3004dd3e702ce1f7835fcece60ee07eee7ec7ad5710288766ed1bd7b

SHA512
469e1b119a86c13db764234a6ad9be5323477fbe7c5b1ecc213830c254fe2eb5e32e26539501b8b1fa2d771a3267310eeef68869ac4584792ccdff7585b2aae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8f0e937e04b1239440a3caf8082487cd

SHA1
5215a6812752617adef80780ebf53d7806dc2038

SHA256
a3d75825a367dfdeb21669044adf74d82b7b1462bf664472bbd4a04f44cef99f

SHA512
c7742f6486fa4d437560a94a8ed91d5867f369a00395300e944188e1f2bed1f8659e15e7df8f593ac642bbf7276a7ab63a4c354bea9b8112525530d01326f0ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9552470ac551b5a0ef8646f25bda8d0b

SHA1
4678ab2e330f75ce5188bfeebe7eb5f14bbd8518

SHA256
d5b2c1cddce0cc66165abe341deab5285cc480c343930b465e4ba3d2933a593c

SHA512
bdf581d9ad9643c92b164207c38213324c41807deb01182bae8a734164c649879dc45ae4fabc4b1395d34703dfd16c0c4239e3b4fe5cbcc40567faa487f0f398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6430cfd1b0d8b49987c2a9f5f82c590b

SHA1
7b067473b3c6b8f4c2e227ed1da2619e199ab72d

SHA256
57d5ab2fabbc8de571e2ca5ff248aafc3ed1c2acc22db83aa383acba35dbaa5c

SHA512
35ebef64c4fca366f16e7ee4d09238010937bf42aa1d51a9c094441faa135d2806f1c89f89c723d69d3d59df577ee83a2baacefb2be0ca18908a0d992101b32b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d1e41e049d37d7946a59df12b5d1b1e

SHA1
f43fdee6edeb3e11bf27a6f6a66eaa3668b6358c

SHA256
abdd9abd9f2dd25c68e213bff844d257ed528358e8d1ac2bc6e72ed86b620f29

SHA512
d06ae79ef4d6aba6061619e8591d8ac2999ffd9f65c86bbd7d6cf8df1fd227219ef5e5dc6a588c625393a539a63a75c9260f70e924465d0008a0689794002857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d555d038867542dfb2fb0575a0d3174e

SHA1
1a5868d6df0b5de26cf3fc7310b628ce0a3726f0

SHA256
044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e

SHA512
d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1a5496f6eb2a6c9d895a646ec50990e0

SHA1
42d676620ea58415e53ecb7cd98a579d60368e64

SHA256
fda446967c4cea1ddb74505a5f231f691618afe04dea33c38d2d2c07850f1a8b

SHA512
4463f8a6be12847d3aa6c30a10bcef5b0e345d30c74d38071e2cd755f764896bb83d6c28954583237e167c33bf5e4df1e2ed6edfcdda4a5c613632c355f49ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1076c10170a5997eb585645a6e047001

SHA1
cfe5e900c5ebdf04e295647fc4464bfa2cde314d

SHA256
97fa9021604024db53bccb9c916656f146b4652dc22bbb9911f6fa6f6a0fd1f4

SHA512
9d8cc58c1d33e637a7b17248a1f31e4840d9dd175647dee56fb4a099a30ca3f7fb126185d59b38d277c56094eec02e8e9fcecb9aa4686526d7085af77206869d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
dacae8c28a4f9732dfb749928728f1a1

SHA1
50c2e9c1c072198a65ae02f828aca0a887cc9097

SHA256
253672eb321682a13f6c55d3cd102ac6ade24402344d58a0869f7534f6d305ff

SHA512
af7aa9e954dd2318ed58ad7f057a225e29527f1d025027b6cbc179ab979eeccb4dbd3a05c5587bf50b14310bce20263e5bcb68864addb2045d064ac8069b1a5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
41932a9a2588d825b7a4ee48b1518860

SHA1
412922466841bb7316b074d626846df6df2e528b

SHA256
5e6e308280cc02257365e8c64d5e799e0e7b29380019facd771a10df9c480bef

SHA512
4a449ac99b5a1882702ba1b24b2a8d61a43e730b7548045e801a1527af7e27e784d1c02b1e7f0dbdeb98753b65364b14fac3f4870eeb6c8b98b5aee8be669c58

Download Submit
C:\Users\Admin\Downloads\EternalBlue.exe-by-kapi2.0peys-main.zip

Filesize
127KB

MD5
66513d8a053f5ae9541d66aafbe9cef0

SHA1
f96bcdac6bf35bf92dba8864d6e412730d32b704

SHA256
2f9f6ee606f938117ef91f9355e471b5a1238eab045cb85b3cf423c6c951cba5

SHA512
45a1a9fdc075de49d8d7f680028e4e19de665798c30d9777c59d6dc9d5ab90dffc9afe6689f6316e7e434f6f851e8cdd555398f571f92ee1f814c390b29f7eb2

Download Submit
C:\Users\Admin\Downloads\Laplace.exe

Filesize
196KB

MD5
15319b08f66fbe58f30193d6eaa56777

SHA1
060951f8929995c364f8526abc46b7cb2f190300

SHA256
5f3f414f19156d7f87cd0c27e8f2318c544def368307fc8bffe97fad1cbab174

SHA512
094f83bbb068ce89966861e96ef47db34b44d94b59aaaad4bff7e555769bbfec28f1c2e77d7a5ee286e2a3dec5ba40cf40409d4bb5e6af8f431171ac2a3cb922

Download Submit
C:\Users\Admin\Downloads\Laplace.exe

Filesize
196KB

MD5
15319b08f66fbe58f30193d6eaa56777

SHA1
060951f8929995c364f8526abc46b7cb2f190300

SHA256
5f3f414f19156d7f87cd0c27e8f2318c544def368307fc8bffe97fad1cbab174

SHA512
094f83bbb068ce89966861e96ef47db34b44d94b59aaaad4bff7e555769bbfec28f1c2e77d7a5ee286e2a3dec5ba40cf40409d4bb5e6af8f431171ac2a3cb922

Download Submit
C:\Users\Admin\Downloads\Laplace.exe

Filesize
196KB

MD5
15319b08f66fbe58f30193d6eaa56777

SHA1
060951f8929995c364f8526abc46b7cb2f190300

SHA256
5f3f414f19156d7f87cd0c27e8f2318c544def368307fc8bffe97fad1cbab174

SHA512
094f83bbb068ce89966861e96ef47db34b44d94b59aaaad4bff7e555769bbfec28f1c2e77d7a5ee286e2a3dec5ba40cf40409d4bb5e6af8f431171ac2a3cb922

Download Submit
memory/2504-578-0x0000000000F30000-0x0000000000F40000-memory.dmp

Filesize
64KB

Download
memory/2504-527-0x00007FFA72A50000-0x00007FFA733F1000-memory.dmp

Filesize
9.6MB

Download
memory/2504-639-0x0000000000F30000-0x0000000000F40000-memory.dmp

Filesize
64KB

Download
memory/2504-615-0x0000000000F30000-0x0000000000F40000-memory.dmp

Filesize
64KB

Download
memory/2504-614-0x0000000000F30000-0x0000000000F40000-memory.dmp

Filesize
64KB

Download
memory/2504-613-0x0000000000F30000-0x0000000000F40000-memory.dmp

Filesize
64KB

Download
memory/2504-494-0x00007FFA72A50000-0x00007FFA733F1000-memory.dmp

Filesize
9.6MB

Download
memory/2504-502-0x0000000000CE0000-0x0000000000CE6000-memory.dmp

Filesize
24KB

Download
memory/2504-504-0x00007FFA72A50000-0x00007FFA733F1000-memory.dmp

Filesize
9.6MB

Download
memory/2504-506-0x0000000000F30000-0x0000000000F40000-memory.dmp

Filesize
64KB

Download
memory/2504-510-0x000000001BCB0000-0x000000001C17E000-memory.dmp

Filesize
4.8MB

Download
memory/2504-512-0x000000001C180000-0x000000001C21C000-memory.dmp

Filesize
624KB

Download
memory/2504-537-0x0000000000F30000-0x0000000000F40000-memory.dmp

Filesize
64KB

Download
memory/2504-577-0x0000000000F30000-0x0000000000F40000-memory.dmp

Filesize
64KB

Download
memory/2504-576-0x0000000000F30000-0x0000000000F40000-memory.dmp

Filesize
64KB

Download
memory/2504-579-0x0000000000D30000-0x0000000000D38000-memory.dmp

Filesize
32KB

Download
memory/3952-612-0x000000001B250000-0x000000001B260000-memory.dmp

Filesize
64KB

Download
memory/3952-509-0x0000000000600000-0x0000000000638000-memory.dmp

Filesize
224KB

Download
memory/3952-611-0x000000001B250000-0x000000001B260000-memory.dmp

Filesize
64KB

Download
memory/3952-511-0x0000000000DE0000-0x0000000000DE6000-memory.dmp

Filesize
24KB

Download
memory/3952-513-0x00007FFA6DE70000-0x00007FFA6E931000-memory.dmp

Filesize
10.8MB

Download
memory/3952-514-0x000000001B250000-0x000000001B260000-memory.dmp

Filesize
64KB

Download
memory/3952-628-0x000000001B250000-0x000000001B260000-memory.dmp

Filesize
64KB

Download
memory/3952-575-0x000000001B250000-0x000000001B260000-memory.dmp

Filesize
64KB

Download
memory/3952-574-0x000000001B250000-0x000000001B260000-memory.dmp

Filesize
64KB

Download
memory/3952-548-0x000000001B250000-0x000000001B260000-memory.dmp

Filesize
64KB

Download
memory/3952-538-0x00007FFA6DE70000-0x00007FFA6E931000-memory.dmp

Filesize
10.8MB

Download
memory/4136-704-0x000000001CB20000-0x000000001CB30000-memory.dmp

Filesize
64KB

Download
memory/4136-683-0x000000001CB20000-0x000000001CB30000-memory.dmp

Filesize
64KB

Download
memory/4136-688-0x000000001CB20000-0x000000001CB30000-memory.dmp

Filesize
64KB

Download
memory/4136-684-0x000000001CB20000-0x000000001CB30000-memory.dmp

Filesize
64KB

Download
memory/4136-671-0x00007FFA6DE70000-0x00007FFA6E931000-memory.dmp

Filesize
10.8MB

Download
memory/4136-685-0x000000001CB20000-0x000000001CB30000-memory.dmp

Filesize
64KB

Download
memory/4136-670-0x000000001CB20000-0x000000001CB30000-memory.dmp

Filesize
64KB

Download
memory/4136-689-0x000000001CB20000-0x000000001CB30000-memory.dmp

Filesize
64KB

Download
memory/4136-669-0x000000001CB20000-0x000000001CB30000-memory.dmp

Filesize
64KB

Download
memory/4136-668-0x000000001CB20000-0x000000001CB30000-memory.dmp

Filesize
64KB

Download
memory/4136-667-0x000000001CB20000-0x000000001CB30000-memory.dmp

Filesize
64KB

Download
memory/4136-666-0x00007FFA6DE70000-0x00007FFA6E931000-memory.dmp

Filesize
10.8MB

Download