hxxp://steamcommunity[.]com/rust/sale100

Analysis

max time kernel
2037s
max time network
2000s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://steamcommunity.com/rust/sale100

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	vds.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\diskmgmt.msc	mmc.exe

Checks SCSI registry key(s) 3 TTPs 16 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 14 IoCs

evasion

pid	Process
6164	taskkill.exe
6604	taskkill.exe
4640	taskkill.exe
6400	taskkill.exe
760	taskkill.exe
6248	taskkill.exe
6288	taskkill.exe
6324	taskkill.exe
6328	taskkill.exe
7092	taskkill.exe
6260	taskkill.exe
6152	taskkill.exe
6216	taskkill.exe
6480	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Internet Explorer\TypedURLs	taskmgr.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c004346534616003100000000005a589971120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe5a58997167581b552e000000a8e101000000010000000000000000000000000000001a54ab004100700070004400610074006100000042000000	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	mmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	mmc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{FCD660D5-A06C-49C9-8987-687CE212C16E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	mmc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 86003100000000005a58a071110053544152544d7e3100006e0009000400efbe5a589971675849552e000000ade101000000010000000000000000004400000000007550e9005300740061007200740020004d0065006e007500000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003600000018000000	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	mmc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	mmc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	mmc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	mmc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlgLegacy	mmc.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	mmc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
4448	msedge.exe
4448	msedge.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5180	mmc.exe
2132	taskmgr.exe
12540	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: 33	5180	mmc.exe
Token: SeIncBasePriorityPrivilege	5180	mmc.exe
Token: 33	5180	mmc.exe
Token: SeIncBasePriorityPrivilege	5180	mmc.exe
Token: 33	5180	mmc.exe
Token: SeIncBasePriorityPrivilege	5180	mmc.exe
Token: 33	5180	mmc.exe
Token: SeIncBasePriorityPrivilege	5180	mmc.exe
Token: 33	5180	mmc.exe
Token: SeIncBasePriorityPrivilege	5180	mmc.exe
Token: SeDebugPrivilege	2132	taskmgr.exe
Token: SeSystemProfilePrivilege	2132	taskmgr.exe
Token: SeCreateGlobalPrivilege	2132	taskmgr.exe
Token: SeCreateGlobalPrivilege	13672	dwm.exe
Token: SeChangeNotifyPrivilege	13672	dwm.exe
Token: 33	13672	dwm.exe
Token: SeIncBasePriorityPrivilege	13672	dwm.exe
Token: SeShutdownPrivilege	13672	dwm.exe
Token: SeCreatePagefilePrivilege	13672	dwm.exe
Token: SeShutdownPrivilege	13672	dwm.exe
Token: SeCreatePagefilePrivilege	13672	dwm.exe
Token: SeShutdownPrivilege	13672	dwm.exe
Token: SeCreatePagefilePrivilege	13672	dwm.exe
Token: SeShutdownPrivilege	13672	dwm.exe
Token: SeCreatePagefilePrivilege	13672	dwm.exe
Token: SeDebugPrivilege	12540	taskmgr.exe
Token: SeSystemProfilePrivilege	12540	taskmgr.exe
Token: SeCreateGlobalPrivilege	12540	taskmgr.exe
Token: 33	2132	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2132	taskmgr.exe
Token: SeShutdownPrivilege	13672	dwm.exe
Token: SeCreatePagefilePrivilege	13672	dwm.exe
Token: SeDebugPrivilege	7092	taskkill.exe
Token: SeShutdownPrivilege	13672	dwm.exe
Token: SeCreatePagefilePrivilege	13672	dwm.exe
Token: SeShutdownPrivilege	13672	dwm.exe
Token: SeCreatePagefilePrivilege	13672	dwm.exe
Token: SeShutdownPrivilege	13672	dwm.exe
Token: SeCreatePagefilePrivilege	13672	dwm.exe
Token: SeDebugPrivilege	6260	taskkill.exe
Token: SeShutdownPrivilege	13672	dwm.exe
Token: SeCreatePagefilePrivilege	13672	dwm.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
5772	NOTEPAD.EXE
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe
2132	taskmgr.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
5180	mmc.exe
5180	mmc.exe
5180	mmc.exe
5180	mmc.exe
5180	mmc.exe
5180	mmc.exe
5180	mmc.exe
5180	mmc.exe
5180	mmc.exe
5180	mmc.exe
5180	mmc.exe
5180	mmc.exe
5180	mmc.exe
2900	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2216	2384	msedge.exe	116
PID 2384 wrote to memory of 2216	2384	msedge.exe	116
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 1040	2384	msedge.exe	117
PID 2384 wrote to memory of 4468	2384	msedge.exe	118
PID 2384 wrote to memory of 4468	2384	msedge.exe	118
PID 2384 wrote to memory of 2944	2384	msedge.exe	119
PID 2384 wrote to memory of 2944	2384	msedge.exe	119
PID 2384 wrote to memory of 2944	2384	msedge.exe	119
PID 2384 wrote to memory of 2944	2384	msedge.exe	119
PID 2384 wrote to memory of 2944	2384	msedge.exe	119
PID 2384 wrote to memory of 2944	2384	msedge.exe	119
PID 2384 wrote to memory of 2944	2384	msedge.exe	119
PID 2384 wrote to memory of 2944	2384	msedge.exe	119
PID 2384 wrote to memory of 2944	2384	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://steamcommunity.com/rust/sale100
1⤵
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=5396 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:1
1⤵
PID:60

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4988 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:1
1⤵
PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5780 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5472 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:1
1⤵
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6056 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe66152e98,0x7ffe66152ea4,0x7ffe66152eb0
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2232 --field-trial-handle=2236,i,3605503803549792054,15762955187004676195,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2388 --field-trial-handle=2236,i,3605503803549792054,15762955187004676195,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2544 --field-trial-handle=2236,i,3605503803549792054,15762955187004676195,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4404 --field-trial-handle=2236,i,3605503803549792054,15762955187004676195,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4404 --field-trial-handle=2236,i,3605503803549792054,15762955187004676195,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4628 --field-trial-handle=2236,i,3605503803549792054,15762955187004676195,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=4908 --field-trial-handle=2236,i,3605503803549792054,15762955187004676195,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5056 --field-trial-handle=2236,i,3605503803549792054,15762955187004676195,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4180 --field-trial-handle=2236,i,3605503803549792054,15762955187004676195,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5428 --field-trial-handle=2236,i,3605503803549792054,15762955187004676195,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5568 --field-trial-handle=2236,i,3605503803549792054,15762955187004676195,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5800 --field-trial-handle=2236,i,3605503803549792054,15762955187004676195,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6092 --field-trial-handle=2236,i,3605503803549792054,15762955187004676195,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6104 --field-trial-handle=2236,i,3605503803549792054,15762955187004676195,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6068 --field-trial-handle=2236,i,3605503803549792054,15762955187004676195,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe66152e98,0x7ffe66152ea4,0x7ffe66152eb0
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2916 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:2
    3⤵
    PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3056 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:3
    3⤵
    PID:2208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3172 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4348 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4348 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4572 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:2132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=4812 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4944 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5232 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5180 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5456 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4632 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:5292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4624 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:5300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4132 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1312 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2920,i,13002965191010685265,9415177253383882869,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:5256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\EditRestart.html
1⤵
PID:3600

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1444
- C:\Windows\system32\mmc.exe
  mmc
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5180
- C:\Windows\system32\mountvol.exe
  mountvol c:\ /d
  2⤵
  PID:5972
- C:\Windows\system32\mountvol.exe
  mountvol
  2⤵
  PID:5372
- C:\Windows\system32\mountvol.exe
  mountvol C:\ /e
  2⤵
  PID:5428
- C:\Windows\system32\mountvol.exe
  mountvol c:\ /d
  2⤵
  PID:4896

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2720

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
PID:4656

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2416

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
PID:5380
- C:\Windows\system32\EaseOfAccessDialog.exe
  "C:\Windows\system32\EaseOfAccessDialog.exe" 211
  2⤵
  PID:1776

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
PID:5272

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
PID:2820
- C:\Windows\system32\mountvol.exe
  mountvol c:\ /d
  2⤵
  PID:6008

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
PID:5192

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
PID:4928

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
PID:5808

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
PID:5504

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
PID:712

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
PID:4660

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
PID:3368

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
PID:464

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.txt
1⤵
PID:1356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:3792
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5348
- - C:\Windows\system32\help.exe
    help
    3⤵
    PID:1932

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.bat
1⤵
PID:1236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:4340
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:5604

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\New Text Document.vbs"
1⤵
PID:1856

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\New Text Document.vbs"
1⤵
PID:5788

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.bat
1⤵
PID:3820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New Text Document.bat" "
1⤵
PID:832
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:4916
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:2604

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\New Text Document.cmd
1⤵
- Suspicious use of FindShellTrayWindow
PID:5772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\New Text Document.cmd" "
1⤵
PID:1156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:4160
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:2220
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:1172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:5620
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:2284
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:3232
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:2272
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:320
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:2524
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:5540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:5304
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:5344
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:5388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:6108
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:3512
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:4352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:5300
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:1444
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:5700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:3792
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:4980
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:1196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:2864
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6024
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:2336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:2920
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:5592
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:4628
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:1944
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:5512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:892
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:2352
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:5624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:1124
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:2544
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:5196
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:1360
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:1108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:5572
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:3244
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:4500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:184
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:2924
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:5820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:2440
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:5252
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:2952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:5784
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:3216
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:5288
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6168
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:5996
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6676
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:3564
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6496
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:5048
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6776
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:5568
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6368
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:6048
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6800
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:5380
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6420
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:1724
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6952
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:2128
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6964
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:4908
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6708
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:1684
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6992
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:4280
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6652
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:1092
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7000
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:6720
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6768
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:7264
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7752
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:7288
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7400
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:7296
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7524
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:7436
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7696
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:7584
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7828
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:7912
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8244
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:7936
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7508
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:7956
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7456
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:7520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:7964
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8096
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8084
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8328
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:8368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8340
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9868
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8376
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9876
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8384
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9580
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8616
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10172
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8648
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:3852
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8656
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10216
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8668
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10312
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8692
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10132
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8712
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:9608
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8732
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10788
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8760
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10636
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8784
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10468
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8800
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10012
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8828
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10764
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8844
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10756
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8872
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10428
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8888
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10812
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8912
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10820
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8936
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10596
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8956
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10356
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:8988
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10880
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:9008
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10804
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:9024
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10912
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:9040
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10052
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:9068
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10796
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:9088
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10604
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:9112
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10864
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:9132
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:10896
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:9896
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11792
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:11820
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11928
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:11936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:11992
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12132
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:12044
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12116
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:12224
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12332
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:12232
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12568
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:12240
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12668
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:9972
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12440
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:12400
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12820
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:13868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:12460
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12752
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:12468
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12772
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:12780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:12968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:12988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:12996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13280
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:14272
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:14284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:12356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:12496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:12456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:5428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K lol.bat
  2⤵
  PID:13580

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2132
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /1
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:12540

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13672

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe"
1⤵
- Kills process with taskkill
PID:760

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe"
1⤵
- Kills process with taskkill
PID:6152

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe"
1⤵
- Kills process with taskkill
PID:6164

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe"
1⤵
- Kills process with taskkill
PID:6216

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe"
1⤵
- Kills process with taskkill
PID:6248

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe"
1⤵
- Kills process with taskkill
PID:6288

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe"
1⤵
- Kills process with taskkill
PID:6324

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe"
1⤵
- Kills process with taskkill
PID:6328

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe"
1⤵
- Kills process with taskkill
PID:6400

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe"
1⤵
- Kills process with taskkill
PID:6480

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe"
1⤵
- Kills process with taskkill
PID:4640

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" f\
1⤵
- Kills process with taskkill
PID:6604

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im cmd.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:7092

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:13736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\lol.bat" "
1⤵
PID:8008
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:6116
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:3212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\lol.bat" "
1⤵
PID:6132
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:784
- C:\Windows\system32\cmd.exe
  cmd.exe
  2⤵
  PID:224

C:\Windows\System32\taskkill.exe
"C:\Windows\System32\taskkill.exe" /f /im cmd.exe
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:6260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Filesize
16KB

MD5
3406d3b708dcef0116bffd8eaa181ad4

SHA1
3df64b48bff2b9d4160d900e91a7670046a24340

SHA256
fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd

SHA512
d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7560af9dda0c5d625f17af4e7d819e8b

SHA1
91e4f133728cbe09489aed81b8c5f0da05b7a4cd

SHA256
d9e55529f549788e74a70078534d4a48bc9b5e1bef72d7fddb2f36d855dbc575

SHA512
8a83bbde806603953d29822252f78b29770c919b17a01069680e1af6512a6a807c49dfad7750490b5e8abab39332658ec3846fadd20cab6069f8a14cc7e014d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
022bf9b1d6dace114de57ceae5719314

SHA1
468468499d94eea69315c56e5646d768c8e35bf2

SHA256
002108481751470321f9badf992a0e9d3d3c19f3592d5ef5392159d4b7f2676f

SHA512
64b9a7b154d6a03a4ca7b29ead0013de0d46ead7950aff80b7f3c87f70b7eed922012b06f89a8a39f1ffc1c36a2d0eef763e1147fcb57ccbc47f2b4c163bb64d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\079dd4bb-d6cc-4723-89e3-cd05b4d828fd.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
334B

MD5
2dcb1a042aa342e7bae5e491e0e2d9ba

SHA1
c1968d136a008b0661411e9cf0374b924866026b

SHA256
e13cc9d8ce79669bcff93203adc6ac7cef92b9b492ecd78c3b9524c4322bda4e

SHA512
f29e19cb7dcbb67bda27d52b29eacc973c0ca739d491c1debb647fabb89e739851715db1cd12118268ec6ab61f404337591841788ea6f5433618344763498b71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
c8533ed122bfa7d580e7621243f3215b

SHA1
6b2380e343b6a76fc85c6da608cccc5fa82d46a4

SHA256
c1c5bc0faad8370cc96e376e8fc039c1af40cd82fcb97ee3aefa7459f97bc149

SHA512
3898fbace8c9633da20718ce046b63aac2aa770d6eff051c17da57c5f62f673ce7c18ba51723521d92de4868871ae24add8659aea9de6b33087a9c41836193dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
b7e74507570006295e074b1a5e9c177c

SHA1
1311e59c11b28d81e8ab5b0c24e526e8af6033c8

SHA256
5693350e4dec1e6bcd951d5cef2e3f912e2a763b411cb0b2ce98067aa5bfaaa5

SHA512
7280a37aea24d509bd3682c0c34f856f47bc086c39c93bf1ea850f20a698009e54da97b502b1e02e048b6c6985ff747b9797bca123f886418c96dd60166ce3cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
8a7786aaea4f74e1e7334950a839728f

SHA1
6e049060b573d2469de6b7c2cb4e54585a498999

SHA256
170b8605dce8f4a8c67273915106c7acf44ef4c9391f6841a217b1380e001dd6

SHA512
2e2d28840d6c00a0aabcfb9126ed3216fad256b41f0f228f53694fcdbbf1b5d1ba7fc9518ab4220318b8d0f1ab66b91590bb4f3d762f24528046486e99feebd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
201aaf777afa443e6ee4dd4478c7f3f5

SHA1
0ad84fc534a51cf02793b7b5508d5c12a2bf0f1c

SHA256
4212f8b4bab8ae579328c9aca747586d9c9bf66687d949fd45968406cb0a0b10

SHA512
616d34e73018ae7e691a0cb98c93444dc07145357bd7dc829ba8c448dd1b10a76d0b1b73f5e7168321a63c4760ce6d25b1953be83fd4081fee1896a38e4e9936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Filesize
346B

MD5
866fc9cbbdb5f0bcf461318347693459

SHA1
10202577962cb32937d0dda10bd08d6cd2fad4c3

SHA256
aad4533228cdd100dfc073ba551e862fcfca731e3a8051699085d2eb114d6cc8

SHA512
1b591b7986264a8562f0131548f364302a18d7e7badc321a3aeb5751b6c5ca389010bd4098ca9408c959a500ea8663d591ba5cec665aae33ee82df0183449d98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Filesize
32KB

MD5
4bb9ac6e72faeca724642933fee1879b

SHA1
6a1e7ced5e5c772e883c85230369df56f654ded9

SHA256
71f98af6eae3264b10e021f43416330636f550efa645a6a833d1b234d40427fd

SHA512
bf9ec85288225c06e4898c066e0fc5629443b33d8d0807883685f201055c56906346f40b376e21b6a18b0e9f685ca2ca77807cf4b4d5eaf11e6fea01864a47bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
32e9e55ead7783af82d1294d5458791c

SHA1
5dfca1677a595275333b5415aecf8ab6e96383fe

SHA256
4caa21ddef852302af8f7a4c19943bb9b94e5bad34af8d88560ed1ce9b9ef386

SHA512
085724a9bccdc9020fa8b2f46d1338c725cc3a4d8dd260bdeed46819baf9d9b97e46aba6b60febbf9c71a6f19efd656a545df1d7392f5d2217a0935bcf2b5386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
dd8cc1a8aa60374a624cd5756511cc8f

SHA1
f805013e1514d13120ada376fbd6989d55d767bb

SHA256
8ffb5c9f41dc3690219031d2d403b7796dfc672fceb86522664d74390ad84ee6

SHA512
51efeca1854d7df1bf40955e08fea82382b25de434d0dd80571d27c0b28d04a6e4bc97a0a95654b1ba7922e8324729e27aeaeec104ef7267290e11af8f6a134f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
334B

MD5
21b9b0a43433a82b88b12e96cf1949b5

SHA1
9034716c4674cf1d49640376afbcede8d264250e

SHA256
b61607fc74b3064375aa7849a7867f4f30eb5e35261d88dcd123a280308bd3ec

SHA512
23919593889430620f59d6fe39218ae91170d06c3326274cfc92ee896953c9719003fa41968ef3a88288dec59a29134ea97c466f24e16255ab0a09bec783174d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
8d7f7b913ade0b1aad60bced0d79a2a8

SHA1
49e80d96031c7bfb429e557813319da82213d615

SHA256
a672d060199b60ce4b806f8150a9292ee5670238d1255ae03db1a9b882b48c2b

SHA512
3caf66b5457b674d54236dd7ae7d76858241e1e86c0d3e4aae4ce585cc813f475b4d6d3a3876323cd6ec8ab827ff648ae6c06948ebc662aab003ea51274f12ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
65626680492b3bda2d94240052204812

SHA1
e9298a8134802637802a91e0a7db0ed83d43c851

SHA256
e3b20e1defe48f1c4aee1fbff34bd6528f6643de7011343008023030ac40308e

SHA512
89d073137d476ccce2543e7ee51eae02a8553c837ba8aaa47e5c376fc1bd066131f39b88d7a86b547e47e16ea938bc6a42325af3e87db815fb5ea13673a56696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Filesize
36KB

MD5
41b3922dfd71b80c69bf212d1b860d67

SHA1
b97da82536dd2c33257325dc01f8d00a4b33854f

SHA256
ae319b79cb6e9cd5541eac864da9689b0ca3b128a5ec17071d102a15bb109abd

SHA512
5ae441aead768e8c60b43a7f39c0695e89a97f9c568f98c36aceea603130dab4744dfc08f81070211d1b0aae26fbc91b80f40a8d6c8c15e47d73b90777149dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
edad72981ad6e802761bd11cc10e6a2b

SHA1
e5869c281567ffa4adf95f4cc929f5f4784527c3

SHA256
6edcc233128c7ed732ff9c8810d6be8ae449ba583d4250cb419300bc0198745c

SHA512
c5386c5e8fa987969722c1e556f896dbb9d342888698371b17a4f4f48f34da0807e2dcdcfa96dbbab0349ecab0dd2961a2dae6fbe6f67503712644bfadb28446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Filesize
20KB

MD5
ba3206dd4440e098aced94571e461ab2

SHA1
03c76b02bed1a481438b6b253d0cea644c15069e

SHA256
50a6153269d51521beebc4d3bf3971b0f2c86ef6d5922312a13e2bbfbe78c45c

SHA512
54141469a55d77f154074aacf0455c41b9752a888f9e01868ed9e27253bd46048ead1ad2d394ba22c56f526f4c9706ce7c63070b61efb24ace613f6eb00be1c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
c79008425606d23e4899aac8aa15b85b

SHA1
ad633802ebb9fce9c97379b34d4cab67cca3cb2a

SHA256
079aff8c48335927b3b18dbda7ac81249add9dfebfeb49950ee07ae37cd060c6

SHA512
a6b3aae1c3f6c31d84fcb86303ec5dbd5ebdc057a443aaf3cfeb2cdbb3b5a1dc3172bb400b6a68a571dd1461e3ae78d0aea9804ad2c336be01aec41292305492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
d16d920392b994a102a7b2b833776301

SHA1
e91786f66d537826e52e2d6d122b0be44b27cb8f

SHA256
973bff81d8baffd5d3eff6a09be9d5316176621044456bd692a8772fe8228b65

SHA512
a99bc855560848cdade99334c9f7c5b16a7ddc697a9f05467d78664853ce154273855b404ac78de4f321150305d8291d75b524f370b981e01e4c4592fc4a63e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
4f23923449d9bbb0e34d310433f7199d

SHA1
b7aa84c559849f50950fb794641856de3d22043f

SHA256
d3da11ba7c4e271bf812fba80b95df9ec8a6a894fe1b28f96e9948a0366d1696

SHA512
12383deacf801bc2760868be109e46ef14e48590bc1a801477be74ae474eb3ec8b1e3079ec6ccfcefe50938204c0db7e225bad0158cd084a10e6ebf41dbdf165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
fb45c016fa87bc4ad3c9aeacd76a824d

SHA1
09f5173828f263794d3fe50440d146a5ff023e19

SHA256
8a321b2681163edf3b9dbe2b7f347df27c4f5f4d9a65ea685060a60b22a2878e

SHA512
c6f62a7ec83b2258d9eeb74fe2bb30872b8d9501234f5ee4fad84a32d49a64d65a132ed74da2a0d0b234c57422d3d7c64e9c63ea2f294063744c5fc65b1a8005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
e37d2e69f54c4a75d38585c290320bf7

SHA1
24b325a6233ace21681db7c3cf0bcd9ae873a352

SHA256
8a346e2a51c9470b6a4470afad52c7478a7fc8d65cfd45b92b863a43c5bafef3

SHA512
975ad01fee5c328ae94ffefbc386409622e27073be5abe82602b759b60f1ca86c6856dbf3e7d79468ca415ed78c06eb10ca8d5b32e78c30482b40f0bcf8a681c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
2a967d22053e94ca9bb947ddc1714c16

SHA1
ee79f9a8374444a171f8dd8da3dcc385e2c8cca8

SHA256
69daeee8e9b0a02322e5192621db8bb89c2f9b7e017e7d5af9f16186a9436462

SHA512
1d1edb86ec630bf9d7dff7a2eafc9d6e7fa1038f2a62608f3c0ae67c6dc640394ccd6a4302f4db1e5518b0d82c6bf0bb4025d45202fec6bc658a299801d9527e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
d452ca0a07dc789609b0bce33822cda3

SHA1
cf80630d0fce3a2a74cc93c67ca2ccead76d2c05

SHA256
cf7addb83fbccb8ce01f08eb0f3d0744b2713690d48f5ff3b54204c35e10622b

SHA512
d4c62eb4b703e7ca9e68a80d4f088c93cc5c245e20148b173e874533861d1c3c017b0b53dc4347d60759f1eba2bb74ac9d3dcb7f9ce3acf3007a30a2b9bd9662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Vpn Tokens

Filesize
28KB

MD5
599549ca7050fda41d48cd1d92212e59

SHA1
9e44dec26d7dbced9ca1214da493f613f9cb0150

SHA256
8eb4364904924eac8f323797cec4569b52c109a32d2d848af8fe3e4fd87eacba

SHA512
bd0da72d7582c887cd2e451841d8dcedf84b7d631220f696ad1b73611e88c77a6a974781b288a422c28cdf91fa74a2d5ca779403282f717a4a59de31b352e933

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Filesize
220KB

MD5
f66e0e2a38a8c391de6245fd377fde72

SHA1
c083b83546abb5a1c69969b01e7632a5bac2cc96

SHA256
344031f306be62c3630ed491474308fd6b63461e2ba1fdd1c68b39f74c4c138c

SHA512
984d40f1e3b0b0a1d12151004b59f16c7b2c4dc1982b850a7d074785150f8e32ec33bca187c0574d927222679f9fb15936e794c86bcda499ec626f64065d5793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json

Filesize
9KB

MD5
55a0c3bb50a6e4395da70e1af9b9b000

SHA1
e38500450db72265d4391d6115087e6f51ea4624

SHA256
79d95218c51705f21a063bfdae6ed893bf94c4c5f6ad48f8727ea51eac38fd4c

SHA512
2797534b5262fc760d78b7c0f1e669d8cab9f8526401244149ca10cd30f345ccbef5d210e4917ec07541bf3ab0153709aa6d2bd933290254f78c99efc4e8e449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
924B

MD5
c69f5b49bb74b3fb03768e7b925b7a2a

SHA1
ee8d52de9e8bdea0951ef8edab251c9cea6d1166

SHA256
569cecca24ee40e91864c4482f0272f50798838a6f976aa35b8fb683c2f1602f

SHA512
e89733aeac47d7578a026c7ba0065f8df829154509651c41641751c75d57d68fb702bcb65fe7a87decac9314280db49dbf367968cb8cda0d8aac316759639293

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
4a5735afe355967255c3eae14b361f44

SHA1
11b42a87edc9c89e4dca5c86eaf6e8651e2a7b5a

SHA256
4beb742884b7e3f6f9cf86b9d3d5a754939005802b7ad174b68faeb5fc9d68b0

SHA512
6d217768a908be8e2522e50916c0d5a9a99c4e587a71a846a2552215d9a7a1b2e1489d0bf86434ccc10da55aaa5118191a57371597b15104b3e76e805b47fa59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
893B

MD5
21eb64c6e0e5a8021eb7c6c7d20570c3

SHA1
a7ce8c915b8f0650053f3f88ba78902252491354

SHA256
5ca9c5127ba11abe1536cee97b0284cd01ea470110ebc2dabb72c8fb95b19d3a

SHA512
26399a1b2a4779d58c45d7f3162e5a1e7eff1f7bed5529de5415e1d1c0169e4acfa7c33339de78bc2463b06e0ad180650cd5ed940dbf24c0b2433c7a47365cb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
f226f926d500b217f0624dd7278b3364

SHA1
e9a5d8be34f9b5cc9e1092ec6f13a4e31ed3fbc8

SHA256
86181103a1a60fdd514ed8946128d4061ff30287c80c95dd5dfc7ceecbd31046

SHA512
0aa1fbeb50043043ff1eb420dd8710e8825dc718c3a4bd9ef3f80445e5e53732a577bc94608d3e6f1c99b9e94a9c6c3e8c4ff9ff10dca93cc5c27119a640bb9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
dd15bd7841f856c0069abe01dae1e85f

SHA1
0de26cf62c6760813d72fcfcb2777bc52537895f

SHA256
bde9aa74e3778eb773b1886db5b8eea70eadcc746d79b57f571addc6a1fb1a71

SHA512
3c5aae89f50169456135664cec6c7a74d5e15ef1a346aff83e6fc50e768b501b0d5ced5022279d3c01a82ca37bfc8cd45bf6365c821b3f63df7694e77f6e7eac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
f9e3387b4cd1c1a3551522bd80cb96c4

SHA1
a218d99dcfb86ebddd63de31df25032a418b5f7c

SHA256
d866c6b2362ccde387108277488cc19a1b34fd73acdd7b0da5467ad489edacb6

SHA512
51226a5991516d4ec1fcfe136eeaac4cfa4300233c3ee83e5e458c18c79e4eedaac31440dcf0558f302344a390ecbfc10820d4f08f0cde3ffa31789b75c7e7e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
77a8b20491f60232cf6412a9021f0f94

SHA1
5308e504020d3e753a2ba06eb040a9ba65c2a738

SHA256
3de41926d68fd946e31c6ba7a182b40e3b4f5e22617951140f3d58dc17414641

SHA512
4bca2a9fefd0959428cd88cb0bc8d6c3ce0e0d2516b2d404edfeb763575fe5ce841657e15b9e1d783e175cbf603449c9fdee8d9ceb33e8d3c460319d0cb9e026

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
4f99e59a36f4389ad9f22b87a1fd9741

SHA1
daaf747aa5603911fdd12e0ca5b17ccc78a94408

SHA256
bfe6bbf462f1d309dd27ca636c5be25d3c022942d2ba5b715b52fa361d0ef7e3

SHA512
03c606f11e1c9bf9f1cc04fc0140ec42d010009228ac29d418aee15c5d9b9bf8391551525d7dce27dca623b3c2327fb8eb001938b5b8a9bd9d3caf81a52ef8d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
9f0786e66f4c80870bd874b7aba0a394

SHA1
74d461c9049086ea0301b956203e7cb59438160d

SHA256
da3e73d31020d249d320f01fc40220043e34ebc99fccaec56c5a97f671a8f227

SHA512
f766b4ee7c28886c1901cf76c1c917e296ddfd3cf843f4f27d7a73db37247ae0dfb8c3f343c4ba124d20f4475e0fb4cf60860215480341715bb907d73630cc6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
70KB

MD5
007cd3fe3a79a380412c3317c09ee4c5

SHA1
2144d31ae8089bc6c042d921187834558a8a4cdc

SHA256
a53c6c8cdaa4b33e67e400e7a6dc419f7f8f83f0f37e7852b09dc2205e77d900

SHA512
75d939b530f6d07476252428adf3c7434b39b9f8d6fe3a3e23852576020c794c70dc5fee6c4eea9d13dba05c19e3d977c6fc052ceba19edd6d1c2f85f62226c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
74KB

MD5
247dad842c868ede26fac7486a3766c5

SHA1
7583cb4002194df193511fe635d68726004c7f95

SHA256
536e71cb3bd73ba05452abf66b5d3199b3ca3e7c1ac11770a025548b8c958b25

SHA512
5b5c74cb862e8240b67c5e34bb87a1e9e1306a0e29a006965df5cfa17997235bcf53c7b707a677ffbdb297154f5f949305721cd84b30b8b3ca7c27c494e141e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
60KB

MD5
0c042028f4bf028e60c712760a0a44ed

SHA1
ea1282bc7031d87dce11aa98369de0956caa61c5

SHA256
c6bd230351cd42d12a396c3583b2fe172ef9024ad69c792e4661b0c054c7cabd

SHA512
05501bb94af7afe11bd2c2b153b181830e3f7178e1dd41913e524110e52ba4a24a2a8b3444d3be1b90b0780e2b3fa78188fa543b3b3bf8ac6db42f99ea9e0a1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
6213647f9833ca512ce7dcb1188f6d49

SHA1
4dae849f58c38d51350abbab2cdbef9893e26bd7

SHA256
f53831961f5c36e0f8438bc8577b6f04d6f92f67be24a90b10cf7510700bb598

SHA512
ebed3e930a4e0759a066d31a48852973ff4a72b249126c77935b3a9a55f05b85e551d5629489c80af23a938d203b4cf9e00e739e0371dc72b2f514ac099f581c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db

Filesize
48KB

MD5
5a1706ef2fb06594e5ec3a3f15fb89e2

SHA1
983042bba239018b3dced4b56491a90d38ba084a

SHA256
87d62d8837ef9e6ab288f75f207ffa761e90a626a115a0b811ae6357bb7a59dd

SHA512
c56a8b94d62b12af6bd86f392faa7c3b9f257bd2fad69c5fa2d5e6345640fe4576fac629ed070b65ebce237759d30da0c0a62a8a21a0b5ef6b09581d91d0aa16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db-journal

Filesize
8KB

MD5
b2665a25920cb1dae625849e63948899

SHA1
ba05e6b5bfa92c0306b68aa148b3e5dbff9329c6

SHA256
7f1e1555f61af1a245c776febfe74e53fbff1ea83cd95a31112b6f3eb6f65433

SHA512
e8ad7a46ef8c43ad89c1d0d2b1fcf933510995405ff5b0cb9bac2af607ef05dbb843948162ad9d0742af746b90eb583343ff15e45e2573264f3654351d648d91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
ba5c5b230c9d9f9acc8e5e23dfd625e0

SHA1
113f27fc6b305d160fba7fd54644f936f77e4bd3

SHA256
1dbb326821776888bba13449f4558a0eeb8d7b8221772c8a810f3c6c68a4ef82

SHA512
0ecdae7b15eaf280517400a795ad7e451d862ea3191b563e57ab61c77e54d31c1d90d0dd2db5f2932d92e4bb3d934275440ceac5994fc23f7f8719a7085c0050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\e0495fde257df2ef62ee7e3fdb1ebb9d7ff72300.tbres

Filesize
4KB

MD5
6406b8d1510556be9cfc0723fbefcd5d

SHA1
2dd1f9508219b428eaab60fdfa1e406fc36249ed

SHA256
978d249857193ff9fdcad4822e82a6d24172ecab4bb1a6869a4adb591348e0a8

SHA512
1fdc205a7e5efad693cf5aea25b11210e12bd3364e904a233a7452e22754a96def61600f91a2bb472964c0c66e2ee5bc42bbd38b961043052175ac2bcca8c209

Download Submit
C:\Users\Admin\AppData\Local\Temp\cv_debug.log

Filesize
1KB

MD5
6de1b737cd8cd125465b946d09d3abc6

SHA1
956b4d2768320730d00f877321c5419a7960c6c1

SHA256
da9ac1ec2e532112eb3f141f13a71f7a5843641ca8bedb881e818daf5b840b50

SHA512
5b45ef268b497b3b9a755b559f191df36ce66edb4e90f4f32f2fe6157a7fb71d523900b1338ef82d582c150b7bbb36a306d161d8dfdcf2bf8cf593a59dde47bb

Download Submit
memory/2132-434-0x0000019811430000-0x0000019811431000-memory.dmp

Filesize
4KB

Download
memory/2132-433-0x0000019811430000-0x0000019811431000-memory.dmp

Filesize
4KB

Download
memory/2132-435-0x0000019811430000-0x0000019811431000-memory.dmp

Filesize
4KB

Download
memory/2132-439-0x0000019811430000-0x0000019811431000-memory.dmp

Filesize
4KB

Download
memory/2132-440-0x0000019811430000-0x0000019811431000-memory.dmp

Filesize
4KB

Download
memory/2132-442-0x0000019811430000-0x0000019811431000-memory.dmp

Filesize
4KB

Download
memory/2132-441-0x0000019811430000-0x0000019811431000-memory.dmp

Filesize
4KB

Download
memory/2132-443-0x0000019811430000-0x0000019811431000-memory.dmp

Filesize
4KB

Download
memory/2132-445-0x0000019811430000-0x0000019811431000-memory.dmp

Filesize
4KB

Download
memory/2132-444-0x0000019811430000-0x0000019811431000-memory.dmp

Filesize
4KB

Download