Analysis

  • max time kernel
    132s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-04-2024 12:32

General

  • Target

    https://www.mediafire.com/folder/sqkgciqfil7m3/Executor2024

Malware Config

Signatures

  • Detect ZGRat V1 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 26 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 20 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3516
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/folder/sqkgciqfil7m3/Executor2024
        2⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2916
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb312246f8,0x7ffb31224708,0x7ffb31224718
          3⤵
            PID:1008
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
            3⤵
              PID:5024
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
              3⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3320
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 /prefetch:8
              3⤵
                PID:1836
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
                3⤵
                  PID:1776
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
                  3⤵
                    PID:4668
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
                    3⤵
                      PID:1764
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
                      3⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1540
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
                      3⤵
                        PID:1692
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
                        3⤵
                          PID:2920
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
                          3⤵
                            PID:2612
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
                            3⤵
                              PID:4944
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
                              3⤵
                                PID:752
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6644 /prefetch:1
                                3⤵
                                  PID:3552
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6900 /prefetch:1
                                  3⤵
                                    PID:912
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7044 /prefetch:8
                                    3⤵
                                      PID:4516
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5568 /prefetch:8
                                      3⤵
                                        PID:5312
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
                                        3⤵
                                          PID:5320
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7384 /prefetch:8
                                          3⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5332
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
                                          3⤵
                                            PID:5880
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1
                                            3⤵
                                              PID:5892
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7560 /prefetch:1
                                              3⤵
                                                PID:5412
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
                                                3⤵
                                                  PID:5440
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7230861492244340388,505424758058314036,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5928 /prefetch:2
                                                  3⤵
                                                    PID:4568
                                                • C:\Program Files\7-Zip\7zG.exe
                                                  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Executor2024\" -spe -an -ai#7zMap2631:86:7zEvent10779
                                                  2⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  PID:5832
                                                • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                  "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                  2⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  PID:556
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                    3⤵
                                                      PID:4872
                                                      • C:\Windows\SysWOW64\tasklist.exe
                                                        tasklist
                                                        4⤵
                                                        • Enumerates processes with tasklist
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5708
                                                      • C:\Windows\SysWOW64\findstr.exe
                                                        findstr /I "wrsa.exe opssvc.exe"
                                                        4⤵
                                                          PID:5684
                                                        • C:\Windows\SysWOW64\tasklist.exe
                                                          tasklist
                                                          4⤵
                                                          • Enumerates processes with tasklist
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3796
                                                        • C:\Windows\SysWOW64\findstr.exe
                                                          findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
                                                          4⤵
                                                            PID:5200
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            cmd /c md 338833
                                                            4⤵
                                                              PID:5228
                                                            • C:\Windows\SysWOW64\findstr.exe
                                                              findstr /V "MasBathroomsCompoundInjection" Participants
                                                              4⤵
                                                                PID:5356
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                cmd /c copy /b Bedrooms + Ratio + Lace + Pipes + Combined + Sampling 338833\J
                                                                4⤵
                                                                  PID:1780
                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\338833\Jesus.pif
                                                                  338833\Jesus.pif 338833\J
                                                                  4⤵
                                                                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                  • Executes dropped EXE
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  • Suspicious use of SendNotifyMessage
                                                                  PID:5988
                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                  ping -n 5 127.0.0.1
                                                                  4⤵
                                                                  • Runs ping.exe
                                                                  PID:1644
                                                            • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                              "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                              2⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              PID:5572
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                3⤵
                                                                  PID:5544
                                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                                    tasklist
                                                                    4⤵
                                                                    • Enumerates processes with tasklist
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:4460
                                                                  • C:\Windows\SysWOW64\findstr.exe
                                                                    findstr /I "wrsa.exe opssvc.exe"
                                                                    4⤵
                                                                      PID:1504
                                                                    • C:\Windows\SysWOW64\tasklist.exe
                                                                      tasklist
                                                                      4⤵
                                                                      • Enumerates processes with tasklist
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:6136
                                                                    • C:\Windows\SysWOW64\findstr.exe
                                                                      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
                                                                      4⤵
                                                                        PID:5564
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd /c md 338963
                                                                        4⤵
                                                                          PID:5984
                                                                        • C:\Windows\SysWOW64\findstr.exe
                                                                          findstr /V "MasBathroomsCompoundInjection" Participants
                                                                          4⤵
                                                                            PID:5704
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            cmd /c copy /b Bedrooms + Ratio + Lace + Pipes + Combined + Sampling 338963\J
                                                                            4⤵
                                                                              PID:5364
                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\338963\Jesus.pif
                                                                              338963\Jesus.pif 338963\J
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              • Suspicious use of SendNotifyMessage
                                                                              PID:4824
                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                              ping -n 5 127.0.0.1
                                                                              4⤵
                                                                              • Runs ping.exe
                                                                              PID:3184
                                                                        • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                          "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                          2⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          PID:5488
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                            3⤵
                                                                              PID:6036
                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                tasklist
                                                                                4⤵
                                                                                • Enumerates processes with tasklist
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1648
                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                findstr /I "wrsa.exe opssvc.exe"
                                                                                4⤵
                                                                                  PID:2240
                                                                                • C:\Windows\SysWOW64\tasklist.exe
                                                                                  tasklist
                                                                                  4⤵
                                                                                  • Enumerates processes with tasklist
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:5672
                                                                                • C:\Windows\SysWOW64\findstr.exe
                                                                                  findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
                                                                                  4⤵
                                                                                    PID:5692
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    cmd /c md 339053
                                                                                    4⤵
                                                                                      PID:5836
                                                                                    • C:\Windows\SysWOW64\findstr.exe
                                                                                      findstr /V "MasBathroomsCompoundInjection" Participants
                                                                                      4⤵
                                                                                        PID:5400
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        cmd /c copy /b Bedrooms + Ratio + Lace + Pipes + Combined + Sampling 339053\J
                                                                                        4⤵
                                                                                          PID:1932
                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\339053\Jesus.pif
                                                                                          339053\Jesus.pif 339053\J
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          • Suspicious use of SendNotifyMessage
                                                                                          PID:5520
                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                          ping -n 5 127.0.0.1
                                                                                          4⤵
                                                                                          • Runs ping.exe
                                                                                          PID:5200
                                                                                    • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                      "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:5464
                                                                                    • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                      "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                      2⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      PID:2312
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                        3⤵
                                                                                          PID:5564
                                                                                      • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                        "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                        2⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        PID:4628
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                          3⤵
                                                                                            PID:5164
                                                                                            • C:\Windows\SysWOW64\tasklist.exe
                                                                                              tasklist
                                                                                              4⤵
                                                                                              • Enumerates processes with tasklist
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:3264
                                                                                            • C:\Windows\SysWOW64\findstr.exe
                                                                                              findstr /I "wrsa.exe opssvc.exe"
                                                                                              4⤵
                                                                                                PID:4624
                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                tasklist
                                                                                                4⤵
                                                                                                • Enumerates processes with tasklist
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2392
                                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                                findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
                                                                                                4⤵
                                                                                                  PID:3604
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  cmd /c md 339283
                                                                                                  4⤵
                                                                                                    PID:624
                                                                                                  • C:\Windows\SysWOW64\findstr.exe
                                                                                                    findstr /V "MasBathroomsCompoundInjection" Participants
                                                                                                    4⤵
                                                                                                      PID:5860
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd /c copy /b Bedrooms + Ratio + Lace + Pipes + Combined + Sampling 339283\J
                                                                                                      4⤵
                                                                                                        PID:6140
                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\339283\Jesus.pif
                                                                                                        339283\Jesus.pif 339283\J
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                        PID:1608
                                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                                        ping -n 5 127.0.0.1
                                                                                                        4⤵
                                                                                                        • Runs ping.exe
                                                                                                        PID:5892
                                                                                                  • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                                    "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                                    2⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    PID:5384
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                                      3⤵
                                                                                                        PID:5840
                                                                                                        • C:\Windows\SysWOW64\tasklist.exe
                                                                                                          tasklist
                                                                                                          4⤵
                                                                                                          • Enumerates processes with tasklist
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:5356
                                                                                                        • C:\Windows\SysWOW64\findstr.exe
                                                                                                          findstr /I "wrsa.exe opssvc.exe"
                                                                                                          4⤵
                                                                                                            PID:1848
                                                                                                          • C:\Windows\SysWOW64\tasklist.exe
                                                                                                            tasklist
                                                                                                            4⤵
                                                                                                            • Enumerates processes with tasklist
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:5316
                                                                                                          • C:\Windows\SysWOW64\findstr.exe
                                                                                                            findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
                                                                                                            4⤵
                                                                                                              PID:5732
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              cmd /c md 339413
                                                                                                              4⤵
                                                                                                                PID:5124
                                                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                                                findstr /V "MasBathroomsCompoundInjection" Participants
                                                                                                                4⤵
                                                                                                                  PID:2164
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  cmd /c copy /b Bedrooms + Ratio + Lace + Pipes + Combined + Sampling 339413\J
                                                                                                                  4⤵
                                                                                                                    PID:5676
                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\339413\Jesus.pif
                                                                                                                    339413\Jesus.pif 339413\J
                                                                                                                    4⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                    PID:1644
                                                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                                                    ping -n 5 127.0.0.1
                                                                                                                    4⤵
                                                                                                                    • Runs ping.exe
                                                                                                                    PID:5940
                                                                                                              • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                                                "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                                                2⤵
                                                                                                                • Checks computer location settings
                                                                                                                • Executes dropped EXE
                                                                                                                PID:4504
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                                                  3⤵
                                                                                                                    PID:5788
                                                                                                                    • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                      tasklist
                                                                                                                      4⤵
                                                                                                                      • Enumerates processes with tasklist
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:1504
                                                                                                                    • C:\Windows\SysWOW64\findstr.exe
                                                                                                                      findstr /I "wrsa.exe opssvc.exe"
                                                                                                                      4⤵
                                                                                                                        PID:4984
                                                                                                                      • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                        tasklist
                                                                                                                        4⤵
                                                                                                                        • Enumerates processes with tasklist
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:5468
                                                                                                                      • C:\Windows\SysWOW64\findstr.exe
                                                                                                                        findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
                                                                                                                        4⤵
                                                                                                                          PID:2696
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /c md 339643
                                                                                                                          4⤵
                                                                                                                            PID:5852
                                                                                                                          • C:\Windows\SysWOW64\findstr.exe
                                                                                                                            findstr /V "MasBathroomsCompoundInjection" Participants
                                                                                                                            4⤵
                                                                                                                              PID:5628
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /c copy /b Bedrooms + Ratio + Lace + Pipes + Combined + Sampling 339643\J
                                                                                                                              4⤵
                                                                                                                                PID:1884
                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\339643\Jesus.pif
                                                                                                                                339643\Jesus.pif 339643\J
                                                                                                                                4⤵
                                                                                                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                PID:5308
                                                                                                                              • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                ping -n 5 127.0.0.1
                                                                                                                                4⤵
                                                                                                                                • Runs ping.exe
                                                                                                                                PID:5684
                                                                                                                          • C:\Windows\system32\taskmgr.exe
                                                                                                                            "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                            2⤵
                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                            PID:3128
                                                                                                                            • C:\Windows\system32\taskmgr.exe
                                                                                                                              "C:\Windows\system32\taskmgr.exe" /1
                                                                                                                              3⤵
                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                              • Modifies registry class
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:2032
                                                                                                                          • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                                                            "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                                                            2⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2564
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                                                              3⤵
                                                                                                                                PID:6036
                                                                                                                                • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                  tasklist
                                                                                                                                  4⤵
                                                                                                                                  • Enumerates processes with tasklist
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:5508
                                                                                                                                • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                  findstr /I "wrsa.exe opssvc.exe"
                                                                                                                                  4⤵
                                                                                                                                    PID:5512
                                                                                                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                    tasklist
                                                                                                                                    4⤵
                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:5000
                                                                                                                                  • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                    findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
                                                                                                                                    4⤵
                                                                                                                                      PID:5096
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      cmd /c md 330693
                                                                                                                                      4⤵
                                                                                                                                        PID:1848
                                                                                                                                      • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                        findstr /V "MasBathroomsCompoundInjection" Participants
                                                                                                                                        4⤵
                                                                                                                                          PID:5476
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          cmd /c copy /b Bedrooms + Ratio + Lace + Pipes + Combined + Sampling 330693\J
                                                                                                                                          4⤵
                                                                                                                                            PID:5676
                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\330693\Jesus.pif
                                                                                                                                            330693\Jesus.pif 330693\J
                                                                                                                                            4⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:5312
                                                                                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                            ping -n 5 127.0.0.1
                                                                                                                                            4⤵
                                                                                                                                            • Runs ping.exe
                                                                                                                                            PID:5852
                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\338833\RegAsm.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\338833\RegAsm.exe
                                                                                                                                        2⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:2008
                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\338833\RegAsm.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\338833\RegAsm.exe
                                                                                                                                        2⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:4444
                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\338833\RegAsm.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\338833\RegAsm.exe
                                                                                                                                        2⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Modifies system certificate store
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:4252
                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\339643\RegAsm.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\339643\RegAsm.exe
                                                                                                                                        2⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:696
                                                                                                                                      • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                                                                        "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                                                                        2⤵
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:5940
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                                                                          3⤵
                                                                                                                                            PID:3672
                                                                                                                                            • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                              tasklist
                                                                                                                                              4⤵
                                                                                                                                              • Enumerates processes with tasklist
                                                                                                                                              PID:5424
                                                                                                                                            • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                              findstr /I "wrsa.exe opssvc.exe"
                                                                                                                                              4⤵
                                                                                                                                                PID:6060
                                                                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                tasklist
                                                                                                                                                4⤵
                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                PID:1456
                                                                                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
                                                                                                                                                4⤵
                                                                                                                                                  PID:5752
                                                                                                                                            • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                                                                              "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Checks computer location settings
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5124
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                                                                                3⤵
                                                                                                                                                  PID:5776
                                                                                                                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                    tasklist
                                                                                                                                                    4⤵
                                                                                                                                                    • Enumerates processes with tasklist
                                                                                                                                                    PID:5344
                                                                                                                                                  • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                    findstr /I "wrsa.exe opssvc.exe"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:5780
                                                                                                                                                • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                                                                                  "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                                                                                  2⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:232
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                                                                                    3⤵
                                                                                                                                                      PID:2956
                                                                                                                                                      • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                        tasklist
                                                                                                                                                        4⤵
                                                                                                                                                        • Enumerates processes with tasklist
                                                                                                                                                        PID:6044
                                                                                                                                                      • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                        findstr /I "wrsa.exe opssvc.exe"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:5452
                                                                                                                                                    • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                                                                                      "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                                                                                      2⤵
                                                                                                                                                      • Checks computer location settings
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4148
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3460
                                                                                                                                                          • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                            tasklist
                                                                                                                                                            4⤵
                                                                                                                                                            • Enumerates processes with tasklist
                                                                                                                                                            PID:5536
                                                                                                                                                          • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                            findstr /I "wrsa.exe opssvc.exe"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:5136
                                                                                                                                                        • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                                                                                          "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                                                                                          2⤵
                                                                                                                                                          • Checks computer location settings
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2544
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1908
                                                                                                                                                              • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                                                                tasklist
                                                                                                                                                                4⤵
                                                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                                                PID:5504
                                                                                                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                findstr /I "wrsa.exe opssvc.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:2408
                                                                                                                                                            • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                                                                                              "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:5224
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5620
                                                                                                                                                              • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                                                                                                "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:4832
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:3944
                                                                                                                                                                  • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                                                                                                    "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:4284
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:1576
                                                                                                                                                                      • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                                                                                                        "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:5316
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1852
                                                                                                                                                                          • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                                                                                                            "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:4944
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:4848
                                                                                                                                                                              • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                                                                                                                "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:6116
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1896
                                                                                                                                                                                  • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe
                                                                                                                                                                                    "C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2088
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        "C:\Windows\system32\cmd.exe" /c move Emotions Emotions.cmd && Emotions.cmd
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4928
                                                                                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:1808
                                                                                                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:2752
                                                                                                                                                                                        • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                          C:\Windows\system32\AUDIODG.EXE 0x2f8 0x45c
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:5068
                                                                                                                                                                                          • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:5568

                                                                                                                                                                                            Network

                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                            Downloads

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              152B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              ae54e9db2e89f2c54da8cc0bfcbd26bd

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              a88af6c673609ecbc51a1a60dfbc8577830d2b5d

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              152B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              f53207a5ca2ef5c7e976cbb3cb26d870

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              49a8cc44f53da77bb3dfb36fc7676ed54675db43

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              33KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              1aca735014a6bb648f468ee476680d5b

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6d28e3ae6e42784769199948211e3aa0806fa62c

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              e563f60814c73c0f4261067bd14c15f2c7f72ed2906670ed4076ebe0d6e9244a

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              808aa9af5a3164f31466af4bac25c8a8c3f19910579cf176033359500c8e26f0a96cdc68ccf8808b65937dc87c121238c1c1b0be296d4306d5d197a1e4c38e86

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              5d5ba21fb8df89236fab8c528ce4b4a7

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              9482d8db1a327977272248b497d4cb72cc15930b

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              12cd7f329178946534c69e80f5ede3d4edcea659d7b2d4084a0be6715f89b5a3

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              e6888d1413006aa61efa49c77ae66f159413b9a3bf0a4ac5f172715f4dd48af14112d16ecf3631c96bf59ffb71b400f7e7787ac593ad895beb0c40dbd527bc8a

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              8KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              7669edf40a2abdaab5a36101a10e2fc8

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              cad8edbebc06b21c133a629e31b46a0a7b94154a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              f5e876370ffa43897769ef123ec55f7f9a8442eecaf0a1da309cb3b751ba7a32

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              34d438bfd62e565382b49fda34a2be537ead784a3146574a40065993dec34e0d0a24f6c75e66f1bd48608349370283d1e8107d0e3e011009559896a551661596

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              6KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              c0b73702f4f67b3dbf5a2d7a55754e56

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              27a09afef90291587e14080881e17d8d083537d3

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              ef513b3fc992e7f10ac8852d16bd8b3569bf916d6b9b332ec0b8ce3957ef04a0

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              be91d8285a9fa3a98f133a093381af8420430a3f839fe91d5a671e68412f86e4ce21e434a28ce5f63a47ccd924e3d3e1b36d29edc5686b02243a6917319af2ab

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              3b6356616a9410b92355bec0d1656898

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              fcb342fe12ec66dd665cceddef2022d75e1b0805

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              3daa4236d6e1da9d28c16117872a7adc02bc61d825a189101fcab0d12ad11d62

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              cd13216d588c31cc4d29184042adc45876e4fe311c2ef0bcfe5735d3cf764637990f016e1384b822db512362b2bd1e1003a3c61b08f8b31fe14c19cbcb5e98b4

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              11KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              0894f9882e638ed4bb26fb1160e527d4

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              f6e43a23b38e2d334c25ceeceea58f6174becf95

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              e49e5675fe6af577bdb75db01a7d83dacbaf191433642ff103aea04a5c4157ee

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              707429506468ee79880ff731c27a1ba27553ce0b25030db599d561304742cef0c97dde9ca7e6fda254297bd1eb1f153cc1f2e4cc37e167d333d0586ba8a7d3be

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              5dec42c7c25466c5d6b884c800b0670a

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              7017c2a614e5a6bd6a04492591c4266f81e38a2d

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              6eee94e3f60abf92e002b1122afa90acdca16bbf547b80b507ef58f8c7426dae

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              3d6f6cb15fdc92f91a43c0e3b1013b4dedd22dbbad26623523d146a85ab08ab640c4acc2de9207b63513424846698cd55a3efa6ed5bc47a2f7fc83982781467d

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a374.TMP

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              4d09310391a90ad814a4f038bb9fe94c

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              40665b95fd1073e18d6db728c34279649cef8247

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              8cff27c7eb80306e45b905e5dd66620aba3c54849ffe2af04f6ac4e421fc4af6

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              0be406f342ae33c462b6844f030bcc30531850594a8ab54e579e0795c462ffd882c9a85645ad1262a9c876abe3e42436ce5a6c1938dfff195a7c71d2a7813b13

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              16B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              11KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              1d2d38e5c2ff4b380f091e86ba31eaf6

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              afc9a11052f961ffe9f25d63c2e372dc2eb07be1

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              8a1ab06b0dd6704f70a1c8f05d7ed898289a043fa5044f6c39fd538f4d80a950

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              bf03ad25de3cfe2409d894b34caf7e8cb7132329f0f3da270e01ab1ad86d89890d943b911d68539682fe99f65fc6f8c8feed59e307241f326f9cfef753786afe

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              11KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              2e678f0085b7a72941457c3d5ed51578

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              7a304552218bc1d5917a0e8ca318a22b86368c75

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              b5905f821392d7587a5165954a75a33cde4004da00cd49d2b41c88f5f2cae6f3

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              d548409424d0bd92442337304d1a15fbfbf96210b72298f8317d7ae9f98c40aca54763f42510c3ea86bfa221628287e446cea50711bdc6e341030777579b4fcb

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\338963\Jesus.pif

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              872KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              6ee7ddebff0a2b78c7ac30f6e00d1d11

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              f2f57024c7cc3f9ff5f999ee20c4f5c38bfc20a2

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              865347471135bb5459ad0e647e75a14ad91424b6f13a5c05d9ecd9183a8a1cf4

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              57d56de2bb882f491e633972003d7c6562ef2758c3731b913ff4d15379ada575062f4de2a48ca6d6d9241852a5b8a007f52792753fd8d8fee85b9a218714efd0

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\339643\RegAsm.exe

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              63KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              0d5df43af2916f47d00c1573797c1a13

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              230ab5559e806574d26b4c20847c368ed55483b0

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Alot

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              225KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              3bdf10ad3101f80cc8dd2df4ef5b870a

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              666ebf8bb9e04f97982abd1d1bc0a24905e83ce4

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              3ad3d40f4fff14517548225300112b77910f883b573f691e46b2ace81524bfd4

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              906cb0fc4c8d0e898242e1b1ea5ee4588112a76c36f2888fa3960b0628c7223a2879ac00828123f2408bf132ffa83336d9de4d8f9c00cb905dbe64cd1ab87fe4

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Bedrooms

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              94KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              84c6b4190b4472f825323138061dc2c0

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              81887b3e3cc3c1fc960f428bbbda2c4bb4ce48f9

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              435083603b405fac709d961eedb60971c0a984ea6beacafb9795f7ceb8077eed

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              688c946bc3ad8561f7c745c06634991464fa55f4b9ea3320f1290cf0bb7b1d949ecee14c44a9d9f16f0c40208b8b2b4d36498f11665aec56ef44405b45153968

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Bedrooms

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              96KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              f0a360362487028ee3609a0dd1a947db

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6f43496da1617f6b8ea8580a2c0ff365fc5830ca

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              83c931f490506d6e4a363fca073ea054ab112ada646cc0d6435bf10572dafa59

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              d99248fff16d1b57d832272323869c884429c258626e2441f03d6466bb47851f2358b970f3fc866ab86b8dc9205a32f2254e690e5924a0fb9949ec781df5f71c

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Combined

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              158KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              fef5867a554ac2c0ba7516aa9c8fddb0

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              c479baae9ad4c10d72ff8cee9c0a828dc401a139

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              842b24d8e1e52e5251f8da65e3cf063a67b3d1ae3ab893466abb892a235f997e

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              aa17c17937a8f554ea9c4578384f8b59aa1e0f4c35931112737b0a6e46b43e12c78f6bca76e3e709c62d7b4e31e4667cfe03ce6544f6dc999e2556f2a0492230

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Emotions

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              25KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              2ef17a5a1a023461c826f2e7589c3442

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              b848b3b6b6a1ab8ecd21a106ab23cb9c0eba3cc3

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              2a79eed6ab683ad918e7d4f466d0fb5eb41df1f7cba5e8e1420f08cb6fced227

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              43c202ad713caed11a8013d1ae5b96c6577322f10651f8e1a2813c285101975c775fcc9a2c2b28350dd92a74badca24bca3a81785eec966c7a8924ebddcf0f24

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Fighter

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              71KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              b002b75d85d54ef205647697eba6b231

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              61ddf40fdf269d87379c69bc5b230056ffe48fcf

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              7d594dfd3fde54680ba02a3208120d12c113bb105e70b5b427b0273d029c7f29

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              e7a4688e8ea55d52e95e464d4b6de03d8a2b2a05d291246133433714d7be2b76bd3f1c05a29cbf28c7aefd0a5ea1805251bace6da28c920f7c90a15dcc13a7f7

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Genre

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              100KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              db4d4e94fa9faf5b106444a7e3e79a99

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              0f37f855eb6bef116d4681b7c5c6d542d44cf020

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              f662dbdadd80b2af3535a76db239f0e45175742a09fb450dc580f0b09881bb45

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              3c7d3f89e539b810b276fba7dbdf836bc4a91be6d414ee1ab9a4bafefdbbd98893d6ca439cb27f3cdac726276d896be475801dbd194cb13b906d395cf2acb109

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Lace

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              187KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              0b450d4b4031be843ee15cdba67f22d8

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              02a5c59608eed5b0ab32e8c7cbc3f238beec6418

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              38aff6344290585d433799a44d8906233f98942e5d87030ab6f2c36f93df1934

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              1e5a4e5e90e17695395b3218be2b50ee4709ed40b67aaa7ccbe7e1599745736e8dc86311ca07038ef63afc35bce3f139e8104088f559412439cb7cfc13c55b19

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ld

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              162KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              10dd7b91ae84b367242505855de57361

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              4a0789bd4a9f57849609d647f4a1c2c3cc672f85

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              5082bc1690af1e5eaf7254ace41522fce1954d9b87a94d77021527eaa1651c42

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              3c1cf2453d5dd98fb587e3c738a211458ca41fecbbcf4bc0d8af589e6ce6a1410414cfe812747c0ce8fdbb5b22148ada41a3f931acf4b58b65e30ea189f2d4be

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Participants

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              227B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              82a38745ff9cefa0859b47b8bd69f535

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6f97750b298ed3f3910e5aa4044b91e7409db9d2

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              92f1df88e0467d0284f1de3e6d30bcf41b0ed56e055719872754627a2b4bb470

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              d22a5ddfacf8c00cde7c3fa27612ca386ae68f79b9c93b52d40be33d584eaf3c18b100da9ad6ba4efacef1cba4fa5d1665e4c3004454f0eb41c3051b98c60569

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Pipes

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              138KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              6fc8b1dfd97b6db0b5df58be006592c0

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              519d7f9d49229d45ba6d730f6647f2d27114d50a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              977a79ffd6e4245ca3703389f0f4d21a8b8a1a8dc6d5f382729b07fcf5fe019a

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              a097b61bd87b6f929e7abfcaafc83b4f4bf903b7c1b5530139e56d62d41ffa24906edecdc2e8aa484854d0fcafb9dcf9c2d6818e288b27c2a1d24054de94f916

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ratio

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              31KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              cd57ba92b96f86da22753e70b8bd63bf

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              10994f9197d3db451cdac2676c3e132d1eff41bd

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              d48af0d3766f7a56e2cdad10b69ff95993703655cfd3f6c720ebfd89298a038c

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              367ced10673ef17a342f0b2f1d97a166d8e50e905a19d761d2bc82d4862e68c0dee1cfa196f15df3d5c0cfbd1f6f7bbc565f574fc93a33f435c85be4d3af5ad9

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ratio

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              33KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              d2facce4c4119e5db6a767b763963b25

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              61adc5b87821dddc3f0e32d8e33c31f1c1dc44df

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              df7a5824f7dc3d4452e7e77f9fa6fb504cc1f1752f69ce76216773da34824ed2

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              7d22c6e6773ebc09187099df98117040141c68de3c01faae6d6d9cc6b66c5bbd35a5cf3054f5370f2068c2c37bd7e0a6e74ec780046a0a93fe76271cb59e64b9

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Richmond

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              258KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              0dcca3ee454e1b725c018b3f2effc53b

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              722d17e8359dda5e1fb166597ed4d309f9f172fc

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              c9ea1557e0185523d8f28193fa178d4f2430971f310a5ac1d616be9c93147497

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              33cb5421a77b77b49e1da3da32d0f83fa46121bd2019aaf390472330f155186a1a4b1e5bd2169411d57621de77dfa2b6ca793257ff27384f4d38d2ab16a33b70

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Sampling

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              110KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              1880c972d53c7d26de256be03d3333da

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              598fa5133219f321ec8dea1d8a1074481b223f46

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              d9802a97a32314ccc2947247b746459921269b1fae426ead9d0571c6495e7210

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              ddf4be5e59ed6760cdcef16f74adae42517f7958c22041911c35410fcac095ae810c22b90a8a5558d8898a7533ad036f3410976f247938e9e3b379802c9f8567

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Sampling

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              122KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              6f7ff7e9c022a77c1fbe326bc03c6224

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              afd1415b2d6c8d335bc31e18320c9b71d99a1aa9

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              a2c30d342c0da74d7723adf1e9ad085396563abb6a565dc63dff6d4bdfdeff20

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              86d9de55ea86ceb8e0a96a8a2bac7563ea2b85ff262da76e964540da4ca283f88a6041064b4d1cc43dc722567ffbbb81908ef323d2fd7f1479d24be8d5de93f8

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Violence

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              56KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              61d45fa8415dcd2098157ae514e3f220

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              8e7cefd62560f94bf5d2f840d0425a8e4cba1ba7

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              d0e91cfb6ea70122be352325dd74b8b38ff6213fabc0129bc42d4f4bcdfd1df5

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              f6907cc3ec01081e038faba3ba02a70c70d26b47c19af4e8751381fc08432b122e9ec051de08511d59038f3c4ab29b7300e6bfc2b8b32023331a22b841c1b3d5

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Tmp3D4D.tmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              1420d30f964eac2c85b2ccfe968eebce

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                                                                                                                                                            • C:\Users\Admin\Downloads\Executor2024.rar

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.3MB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              377830a4d360be9efc533f75c43d949a

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              06c173f89b978cce8a6f918ecacfb93b9c2b9410

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              e8480aaeace21049c64778ee47a1a46676613cc563f85820c1bcdb71ee81a6a7

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              928c65587cf598212f0124ec93c60d81e6efe7425898e910b2366937e79c5f36be4e23314a08278113189f8dfddf4cf8ee99b5e4291302007b44f9ae7a0718ca

                                                                                                                                                                                            • C:\Users\Admin\Downloads\Executor2024\Executor Installer.exe

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              300.0MB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              ce52d76fa19eef8e2ba89a9eee3911cc

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              2d44c9a520a92e508e69622b481dd0363da80b80

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              e49f4be0e09d6360d6fe877dc7245a5ca0f9c91cbb73688dc62038ed096d5b09

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              fd6323b7d6006ddd4f728097481873353ecd50d262be514a316e0c16c6bb2f91be7963f4931c96f7383ae811944696e8b365f8176ff21638725f6ef42e815550

                                                                                                                                                                                            • \??\pipe\LOCAL\crashpad_2916_OXYAKRAKWKLVNCTN

                                                                                                                                                                                              MD5

                                                                                                                                                                                              d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                            • memory/696-648-0x0000000000950000-0x0000000000A10000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              768KB

                                                                                                                                                                                            • memory/3128-530-0x00000182B2E30000-0x00000182B2E31000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/3128-541-0x00000182B2E30000-0x00000182B2E31000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/3128-540-0x00000182B2E30000-0x00000182B2E31000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/3128-539-0x00000182B2E30000-0x00000182B2E31000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/3128-538-0x00000182B2E30000-0x00000182B2E31000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/3128-537-0x00000182B2E30000-0x00000182B2E31000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/3128-536-0x00000182B2E30000-0x00000182B2E31000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/3128-542-0x00000182B2E30000-0x00000182B2E31000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/3128-531-0x00000182B2E30000-0x00000182B2E31000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/3128-532-0x00000182B2E30000-0x00000182B2E31000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4252-594-0x0000000001400000-0x00000000014C0000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              768KB

                                                                                                                                                                                            • memory/4252-597-0x0000000005B00000-0x0000000005B0A000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              40KB

                                                                                                                                                                                            • memory/4252-600-0x0000000008E40000-0x0000000009458000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              6.1MB

                                                                                                                                                                                            • memory/4252-601-0x00000000089B0000-0x0000000008ABA000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.0MB

                                                                                                                                                                                            • memory/4252-602-0x0000000008900000-0x0000000008912000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              72KB

                                                                                                                                                                                            • memory/4252-603-0x0000000008960000-0x000000000899C000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              240KB

                                                                                                                                                                                            • memory/4252-604-0x0000000008AC0000-0x0000000008B0C000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              304KB

                                                                                                                                                                                            • memory/4252-605-0x0000000008C60000-0x0000000008CC6000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              408KB

                                                                                                                                                                                            • memory/4252-606-0x00000000095E0000-0x0000000009656000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              472KB

                                                                                                                                                                                            • memory/4252-607-0x0000000009560000-0x000000000957E000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              120KB

                                                                                                                                                                                            • memory/4252-608-0x000000000A360000-0x000000000A522000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.8MB

                                                                                                                                                                                            • memory/4252-609-0x000000000AA60000-0x000000000AF8C000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5.2MB

                                                                                                                                                                                            • memory/4252-596-0x0000000005B50000-0x0000000005BE2000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              584KB

                                                                                                                                                                                            • memory/4252-595-0x0000000006100000-0x00000000066A4000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              5.6MB