dcrat | 08cf615cded88dc7bc2f0575ddb3c05e1201f07f523ee7b119440a449f53ee7d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
21-05-2024 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

redirect.html
Size

6KB
MD5

ceda84f20bde5c3b5c554bd819e1c381
SHA1

9ee3242ece7a3f075987b7fc9dad73db51dfd29b
SHA256

08cf615cded88dc7bc2f0575ddb3c05e1201f07f523ee7b119440a449f53ee7d
SHA512

a8d6cf26d88696b742790177802c747f6e966005a32d35d6cda438842d74e07b988c6d31a12c4d87062b25a5ac7df1f369963a093efe371f109858908b5f61e9
SSDEEP

192:dzHLxX7777/77QF7Ryrd0Lod4BYCIp8OOXI:dzr5HYK0+CIp8OOXI

Score

10^/10

dcrat discovery execution infostealer persistence rat spyware stealer

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 13 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\smss.exe\", \"C:\\Program Files\\Google\\Chrome\\explorer.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\smss.exe\", \"C:\\Program Files\\Google\\Chrome\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\services.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\smss.exe\", \"C:\\Program Files\\Google\\Chrome\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\services.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\browserwinsvc.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\smss.exe\", \"C:\\Program Files\\Google\\Chrome\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\services.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\browserwinsvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\smss.exe\", \"C:\\Program Files\\Google\\Chrome\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\services.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\browserwinsvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\msedge.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\smss.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\smss.exe\", \"C:\\Program Files\\Google\\Chrome\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\services.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\smss.exe\", \"C:\\Program Files\\Google\\Chrome\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\services.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\browserwinsvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\msedge.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\sppsvc.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\smss.exe\", \"C:\\Program Files\\Google\\Chrome\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\services.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\browserwinsvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\msedge.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\sppsvc.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\Arcane CheatSetup.exe\", \"C:\\Program Files\\MSBuild\\fontdrvhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\smss.exe\", \"C:\\Program Files\\Google\\Chrome\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\services.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\smss.exe\", \"C:\\Program Files\\Google\\Chrome\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\services.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\browserwinsvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\msedge.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\sppsvc.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\Arcane CheatSetup.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\smss.exe\", \"C:\\Program Files\\Google\\Chrome\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\services.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\browserwinsvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\msedge.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\sppsvc.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\Arcane CheatSetup.exe\", \"C:\\Program Files\\MSBuild\\fontdrvhost.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\wininit.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\smss.exe\", \"C:\\Program Files\\Google\\Chrome\\explorer.exe\", \"C:\\Surrogateprovidercomponentsessionmonitor\\services.exe\", \"C:\\Recovery\\WindowsRE\\wininit.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\browserwinsvc.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\", \"C:\\Recovery\\WindowsRE\\msedge.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\""	browserwinsvc.exe

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4540	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2080	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1584	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4304	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4808	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4228	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1056	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2572	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1088	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3988	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	992	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4536	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4516	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2632	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	484	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1224	2284	schtasks.exe	124
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	768	2284	schtasks.exe	124

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000200000002aa35-467.dat	dcrat
behavioral1/files/0x000300000002aa06-486.dat	dcrat
behavioral1/memory/4188-492-0x0000000000400000-0x0000000003281000-memory.dmp	dcrat
behavioral1/files/0x000200000002aa8d-505.dat	dcrat
behavioral1/memory/840-507-0x00000000007C0000-0x0000000000932000-memory.dmp	dcrat

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4248	powershell.exe
1052	powershell.exe
2304	powershell.exe
2328	powershell.exe
4992	powershell.exe
1328	powershell.exe
1020	powershell.exe
384	powershell.exe
3956	powershell.exe
2900	powershell.exe
4104	powershell.exe
3820	powershell.exe
4352	powershell.exe
1644	powershell.exe

Executes dropped EXE 8 IoCs

pid	Process
4188	Arcane Cheat.exe
2560	Arcane CheatSetup.exe
3772	Arcane CheatSetup.tmp
1096	Arcane Cheat.exe
840	browserwinsvc.exe
1976	dllhost.exe
4516	Arcane Cheat.exe
4896	javaw.exe

Loads dropped DLL 15 IoCs

pid	Process
4896	javaw.exe
4896	javaw.exe
4896	javaw.exe
4896	javaw.exe
4896	javaw.exe
4896	javaw.exe
4896	javaw.exe
4896	javaw.exe
4896	javaw.exe
4896	javaw.exe
4896	javaw.exe
4896	javaw.exe
4896	javaw.exe
4896	javaw.exe
4896	javaw.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Google\\Chrome\\explorer.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Arcane CheatSetup = "\"C:\\Surrogateprovidercomponentsessionmonitor\\Arcane CheatSetup.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Windows Mail\\smss.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Surrogateprovidercomponentsessionmonitor\\services.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\browserwinsvc = "\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\browserwinsvc.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\dwm.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Windows Mail\\smss.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Recovery\\WindowsRE\\sysmon.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Arcane CheatSetup = "\"C:\\Surrogateprovidercomponentsessionmonitor\\Arcane CheatSetup.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\MSBuild\\fontdrvhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Surrogateprovidercomponentsessionmonitor\\services.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Surrogateprovidercomponentsessionmonitor\\wininit.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Recovery\\WindowsRE\\sysmon.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Surrogateprovidercomponentsessionmonitor\\sppsvc.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Surrogateprovidercomponentsessionmonitor\\sppsvc.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Recovery\\WindowsRE\\msedge.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Recovery\\WindowsRE\\msedge.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\browserwinsvc = "\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\browserwinsvc.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Google\\Chrome\\explorer.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Recovery\\WindowsRE\\wininit.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\dllhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files\\MSBuild\\fontdrvhost.exe\""	browserwinsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Surrogateprovidercomponentsessionmonitor\\wininit.exe\""	browserwinsvc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ipinfo.io
15	ip-api.com
71	ipinfo.io

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Mail\smss.exe	browserwinsvc.exe
File created	C:\Program Files (x86)\Arcane Cheat\is-1O00K.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-VA8FC.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\is-UOV7F.tmp	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\JavaAccessBridge-32.dll	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-Q2J4O.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe	browserwinsvc.exe
File opened for modification	C:\Program Files (x86)\Arcane Cheat\Arcane Cheat.exe	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-P6FRP.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\management\is-N5UUN.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\jfr\is-5FD2I.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-0LP65.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-HV7AF.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\deploy\is-DEGNG.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\images\cursors\is-70O30.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-K0BJ3.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\deploy\is-4IDUU.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\fonts\is-BR05T.tmp	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\dtplugin\npdeployJava1.dll	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\is-UGO5B.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\cmm\is-PNJKK.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-9R4F1.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\ext\is-B985F.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\i386\is-39VMT.tmp	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\rmiregistry.exe	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\cmm\is-QKFLO.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\lib\is-HHR8V.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-87R0G.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-B0J9E.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-B1K1N.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-PO2L5.tmp	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\hprof.dll	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\jabswitch.exe	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\javaw.exe	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-BS4U0.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\client\is-6DJOC.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\deploy\is-E9206.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-65NFD.tmp	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\javaws.exe	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\is-154R8.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-A6ER8.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-2T10K.tmp	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\mlib_image.dll	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-G454T.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\dtplugin\is-EPCFQ.tmp	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\eula.dll	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\klist.exe	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\policytool.exe	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-J2DUU.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\client\is-R14K2.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\is-U207D.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\is-NAJ28.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\deploy\is-4QJ0D.tmp	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\prism_sw.dll	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\jfxmedia.dll	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-6KQH3.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\bin\is-352QU.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\fonts\is-JV70E.tmp	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\management\is-NCIV2.tmp	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\j2pcsc.dll	Arcane CheatSetup.tmp
File created	C:\Program Files (x86)\Arcane Cheat\jre\lib\is-5TK23.tmp	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\fxplugins.dll	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\glass.dll	Arcane CheatSetup.tmp
File opened for modification	C:\Program Files (x86)\Arcane Cheat\jre\bin\jpeg.dll	Arcane CheatSetup.tmp

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\servicing\en-US\sihost.exe	browserwinsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4540	schtasks.exe
5080	schtasks.exe
3988	schtasks.exe
4796	schtasks.exe
952	schtasks.exe
768	schtasks.exe
4300	schtasks.exe
4396	schtasks.exe
4516	schtasks.exe
2044	schtasks.exe
2868	schtasks.exe
4772	schtasks.exe
2572	schtasks.exe
992	schtasks.exe
2632	schtasks.exe
4648	schtasks.exe
4304	schtasks.exe
4536	schtasks.exe
2080	schtasks.exe
2312	schtasks.exe
3364	schtasks.exe
2664	schtasks.exe
1224	schtasks.exe
2052	schtasks.exe
4504	schtasks.exe
780	schtasks.exe
3036	schtasks.exe
2604	schtasks.exe
1584	schtasks.exe
4808	schtasks.exe
4228	schtasks.exe
1056	schtasks.exe
1088	schtasks.exe
772	schtasks.exe
3052	schtasks.exe
112	schtasks.exe
4468	schtasks.exe
560	schtasks.exe
484	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings	Arcane Cheat.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Applications\7zFM.exe\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000009a580d7c1000372d5a6970003c0009000400efbe9a580d7c9a580d7c2e0000003f9f020000001c000000000000000000000000000000d9bacb0037002d005a0069007000000014000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Applications\7zFM.exe\shell\open	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Applications	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c003100000000009a58247f110050524f4752417e310000740009000400efbec55259619a58247f2e0000003f0000000000010000000000000000004a0000000000666d0401500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Applications\7zFM.exe\shell	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Applications\7zFM.exe	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	OpenWith.exe
Key created	\Registry\User\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\NotificationData	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Arcane_Cheat.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2228	msedge.exe
2228	msedge.exe
112	identity_helper.exe
112	identity_helper.exe
3368	msedge.exe
3368	msedge.exe
3704	msedge.exe
3704	msedge.exe
840	browserwinsvc.exe
840	browserwinsvc.exe
1052	powershell.exe
1052	powershell.exe
3820	powershell.exe
3820	powershell.exe
1644	powershell.exe
1644	powershell.exe
4992	powershell.exe
4992	powershell.exe
4352	powershell.exe
4352	powershell.exe
4104	powershell.exe
4104	powershell.exe
3956	powershell.exe
3956	powershell.exe
384	powershell.exe
384	powershell.exe
2304	powershell.exe
2304	powershell.exe
2328	powershell.exe
2328	powershell.exe
4248	powershell.exe
4248	powershell.exe
1328	powershell.exe
1328	powershell.exe
2900	powershell.exe
2900	powershell.exe
1020	powershell.exe
1020	powershell.exe
4104	powershell.exe
1052	powershell.exe
4352	powershell.exe
3820	powershell.exe
1644	powershell.exe
1328	powershell.exe
2328	powershell.exe
4992	powershell.exe
384	powershell.exe
3956	powershell.exe
4248	powershell.exe
1020	powershell.exe
2304	powershell.exe
2900	powershell.exe
1976	dllhost.exe
1976	dllhost.exe
1976	dllhost.exe
3772	Arcane CheatSetup.tmp
3772	Arcane CheatSetup.tmp
1976	dllhost.exe
1976	dllhost.exe
1976	dllhost.exe
1976	dllhost.exe
1976	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
3320	OpenWith.exe
4180	7zFM.exe
3668	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeRestorePrivilege	4180	7zFM.exe
Token: 35	4180	7zFM.exe
Token: SeSecurityPrivilege	4180	7zFM.exe
Token: SeRestorePrivilege	3668	7zFM.exe
Token: 35	3668	7zFM.exe
Token: SeSecurityPrivilege	3668	7zFM.exe
Token: SeDebugPrivilege	840	browserwinsvc.exe
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeDebugPrivilege	3820	powershell.exe
Token: SeDebugPrivilege	1644	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	384	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	1020	powershell.exe
Token: SeDebugPrivilege	1976	dllhost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3320	OpenWith.exe
3320	OpenWith.exe
3320	OpenWith.exe
3320	OpenWith.exe
3320	OpenWith.exe
3320	OpenWith.exe
3320	OpenWith.exe
3320	OpenWith.exe
3320	OpenWith.exe
3320	OpenWith.exe
3320	OpenWith.exe
3320	OpenWith.exe
4896	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 3172	2228	msedge.exe	79
PID 2228 wrote to memory of 3172	2228	msedge.exe	79
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2016	2228	msedge.exe	80
PID 2228 wrote to memory of 2108	2228	msedge.exe	81
PID 2228 wrote to memory of 2108	2228	msedge.exe	81
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82
PID 2228 wrote to memory of 3144	2228	msedge.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\redirect.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa358e3cb8,0x7ffa358e3cc8,0x7ffa358e3cd8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1904,18134403804864146437,14983724571453308947,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4112 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2292

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3320
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Arcane_Cheat.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:4180

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1200

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Arcane_Cheat.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Users\Admin\Desktop\Arcane Cheat.exe
"C:\Users\Admin\Desktop\Arcane Cheat.exe"
1⤵
- Executes dropped EXE
PID:4188
- C:\Users\Admin\AppData\Local\Temp\Arcane CheatSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\Arcane CheatSetup.exe"
  2⤵
  - Executes dropped EXE
  PID:2560
- - C:\Users\Admin\AppData\Local\Temp\is-VRI8M.tmp\Arcane CheatSetup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-VRI8M.tmp\Arcane CheatSetup.tmp" /SL5="$8005A,46527891,119296,C:\Users\Admin\AppData\Local\Temp\Arcane CheatSetup.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:3772
  - - C:\Program Files (x86)\Arcane Cheat\Arcane Cheat.exe
      "C:\Program Files (x86)\Arcane Cheat\Arcane Cheat.exe"
      4⤵
      Executes dropped EXE
      PID:4516
    - - C:\Program Files (x86)\Arcane Cheat\jre\bin\javaw.exe
        
        "C:\Program Files (x86)\Arcane Cheat\jre\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\asm-all.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-json-ext.jar;lib\jphp-runtime.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar" org.develnext.jphp.ext.javafx.FXLauncher
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:4896
- C:\Users\Admin\AppData\Local\Temp\Arcane Cheat.exe
  "C:\Users\Admin\AppData\Local\Temp\Arcane Cheat.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:1096
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Surrogateprovidercomponentsessionmonitor\lEI1Ux7.vbe"
    3⤵
    PID:1492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Surrogateprovidercomponentsessionmonitor\bjWdhUfYhC7CKzpdCHePv6eJ.bat" "
      4⤵
      PID:3476
    - - C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe
        
        "C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2328
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\smss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\explorer.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1052
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogateprovidercomponentsessionmonitor\services.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3820
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\wininit.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:384
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2900
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\en-US\browserwinsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4248
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\Accessories\en-US\dwm.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4104
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\msedge.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1020
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sysmon.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3956
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogateprovidercomponentsessionmonitor\sppsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1644
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogateprovidercomponentsessionmonitor\Arcane CheatSetup.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4352
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\fontdrvhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1328
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Surrogateprovidercomponentsessionmonitor\wininit.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4992
      - C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe
        
        "C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\Chrome\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Surrogateprovidercomponentsessionmonitor\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Surrogateprovidercomponentsessionmonitor\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\Surrogateprovidercomponentsessionmonitor\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "browserwinsvcb" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\browserwinsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "browserwinsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\browserwinsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "browserwinsvcb" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\browserwinsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Surrogateprovidercomponentsessionmonitor\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2632

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Surrogateprovidercomponentsessionmonitor\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Surrogateprovidercomponentsessionmonitor\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Arcane CheatSetupA" /sc MINUTE /mo 14 /tr "'C:\Surrogateprovidercomponentsessionmonitor\Arcane CheatSetup.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Arcane CheatSetup" /sc ONLOGON /tr "'C:\Surrogateprovidercomponentsessionmonitor\Arcane CheatSetup.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Arcane CheatSetupA" /sc MINUTE /mo 12 /tr "'C:\Surrogateprovidercomponentsessionmonitor\Arcane CheatSetup.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Surrogateprovidercomponentsessionmonitor\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Surrogateprovidercomponentsessionmonitor\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Surrogateprovidercomponentsessionmonitor\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Arcane Cheat\Arcane Cheat.exe

Filesize
32KB

MD5
ca86297e7a02a2c1e91c4ecc897b7dcc

SHA1
a2e3eae2dd5bad41f349818f004dbe1ba89c1e89

SHA256
8c3e900295aa5a4571719ccf6ac6739febff2865755f1e75c38433c29283a67a

SHA512
6613575793250f50c9a319b6f1cd758d9d74651b1ab1da366a99d308c3384ecf4ad240a8aa14bc6d3c547dbe283fb8b9055aeda73573cd784a8aa43c79b97c2e

Download Submit
C:\Program Files (x86)\Arcane Cheat\jre\bin\client\jvm.dll

Filesize
3.7MB

MD5
39c302fe0781e5af6d007e55f509606a

SHA1
23690a52e8c6578de6a7980bb78aae69d0f31780

SHA256
b1fbdbb1e4c692b34d3b9f28f8188fc6105b05d311c266d59aa5e5ec531966bc

SHA512
67f91a75e16c02ca245233b820df985bd8290a2a50480dff4b2fd2695e3cf0b4534eb1bf0d357d0b14f15ce8bd13c82d2748b5edd9cc38dc9e713f5dc383ed77

Download Submit
C:\Program Files (x86)\Arcane Cheat\jre\bin\javaw.exe

Filesize
187KB

MD5
48c96771106dbdd5d42bba3772e4b414

SHA1
e84749b99eb491e40a62ed2e92e4d7a790d09273

SHA256
a96d26428942065411b1b32811afd4c5557c21f1d9430f3696aa2ba4c4ac5f22

SHA512
9f891c787eb8ceed30a4e16d8e54208fa9b19f72eeec55b9f12d30dc8b63e5a798a16b1ccc8cea3e986191822c4d37aedb556e534d2eb24e4a02259555d56a2c

Download Submit
C:\Program Files (x86)\Arcane Cheat\jre\bin\msvcr100.dll

Filesize
755KB

MD5
bf38660a9125935658cfa3e53fdc7d65

SHA1
0b51fb415ec89848f339f8989d323bea722bfd70

SHA256
60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa

SHA512
25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

Download Submit
C:\Program Files (x86)\Arcane Cheat\jre\lib\i386\jvm.cfg

Filesize
657B

MD5
9fd47c1a487b79a12e90e7506469477b

SHA1
7814df0ff2ea1827c75dcd73844ca7f025998cc6

SHA256
a73aea3074360cf62adedc0c82bc9c0c36c6a777c70da6c544d0fba7b2d8529e

SHA512
97b9d4c68ac4b534f86efa9af947763ee61aee6086581d96cbf7b3dbd6fd5d9db4b4d16772dce6f347b44085cef8a6ea3bfd3b84fbd9d4ef763cef39255fbce3

Download Submit
C:\Program Files (x86)\Arcane Cheat\jre\lib\images\cursors\is-AN13H.tmp

Filesize
153B

MD5
1e9d8f133a442da6b0c74d49bc84a341

SHA1
259edc45b4569427e8319895a444f4295d54348f

SHA256
1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

SHA512
63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

Download Submit
C:\Surrogateprovidercomponentsessionmonitor\bjWdhUfYhC7CKzpdCHePv6eJ.bat

Filesize
63B

MD5
6de687cf7ca366429c953cb49905b70a

SHA1
58e2c1823c038d8da8a2f042672027184066279e

SHA256
80d02a1cb8e68ffbc609a6c4914600604153ce929d46994200f837d354a5a611

SHA512
6bfa7a07d6adf167458cece0ba3a110479ee7677feb58c0ae9ba5c8913bcdda13664060ce0261abc1668c18831d5c73f6bc570be8595323d46704b810fc024ef

Download Submit
C:\Surrogateprovidercomponentsessionmonitor\browserwinsvc.exe

Filesize
1.4MB

MD5
e780bb029d808cb41937f4f7cd022b45

SHA1
ad1a7bc098d991e576cf59aa87d844e2991da43a

SHA256
772574576b825f97aa91ce0d24b0ba83fdb0de3a0545296e1d6d28f1349f1456

SHA512
0152df85a9ebe44f750bfbb53735400cb08b406dcde80c2fba7627d00533b485ae1b3cb419f9c895f22b05582fb25e0ae2f6b12e9afb78f721c75fe019e6dda5

Download Submit
C:\Surrogateprovidercomponentsessionmonitor\lEI1Ux7.vbe

Filesize
241B

MD5
3944ff0b2b8a1617f5e571ebc259a0e6

SHA1
17137e6ccd0437adecb866e9b44f94cebbbdd878

SHA256
693c79dbd630e1180ddb96b8d51895a9f27a01ae25c27aebbc55be5e4874335d

SHA512
0e76c530e8739f559989e3657ed06a91d121ba37dc18d15c2feca9ac986bad1adcfc6e86d54b097483f08c8bfd890079280c46029f71707c02d02af96d767b03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1967b002-5173-4208-b7b4-9b939832d05b.tmp

Filesize
11KB

MD5
5a8d265def47653661a379c9ca05dc6d

SHA1
701b34094e3d43fe999d98920d3114ac0a94c42d

SHA256
8a16d6df36f589b91f0c0a1acd2ca395cacdc76bfb07bb081b3dddaf44883364

SHA512
1c70545046d5419cffbbe9993edd55a67630d4f43a59307cb8aea7b17f52a63ade7f806d003bad79a40e1d6757c07d403f144e4c1b64aaf8f14d10bf07d79b78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e4ed4a50489e7fc6c3ce17686a7cd94

SHA1
eac4e98e46efc880605a23a632e68e2c778613e7

SHA256
fc9e8224722cb738d8b32420c05006de87161e1d28bc729b451759096f436c1a

SHA512
5c4e637ac4da37ba133cb1fba8fa2ff3e24fc4ca15433a94868f2b6e0259705634072e5563da5f7cf1fd783fa8fa0c584c00f319f486565315e87cdea8ed1c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8ff8bdd04a2da5ef5d4b6a687da23156

SHA1
247873c114f3cc780c3adb0f844fc0bb2b440b6d

SHA256
09b7b20bfec9608a6d737ef3fa03f95dcbeaca0f25953503a321acac82a5e5ae

SHA512
5633ad84b5a003cd151c4c24b67c1e5de965fdb206b433ca759d9c62a4785383507cbd5aca92089f6e0a50a518c6014bf09a0972b4311464aa6a26f76648345e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
56KB

MD5
0f88ab2700361c3c178d41d1cde1a531

SHA1
712f1844a4e166b1cac72764f71b066928160d9e

SHA256
ba07596fe72154090638cadadb1d4ec92d0a96b2f5ab14558eabee7faf95f134

SHA512
8dca52b568b0a421320813a91aecb5252d05febd8d1b3d4362d6b30406e8d4e9f255a779d112d79d57cc8150673bda50de4e916f934639a13ea674885429a4e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
480B

MD5
10329145cb370acc439a32341f1dc8eb

SHA1
10fc2db855b28df447d73becaedddf6a4e0eacea

SHA256
6a6440409f4cb32bdade00c29a8a7e665e1fceee10f5bb7a7d0efc89d3c07826

SHA512
58a71f3a100284ef03907ef0f042cf6d2c5695dcdd30eb0df8d5e55dc91c7f44468969f24243c72f8ae939b4c334904992a4a3f042b0bf54966359b5f1276766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
ac47b17bb22aa7c1e70a1d40cd12191b

SHA1
b9fbfbf9e3ef1a619e4e202ebe1c54db9d18b47d

SHA256
6c17a73aa92b457f0049eb6a611e2e5cc4c6edb47c1d78899dc97ccb5990eb8d

SHA512
8eac713a834d1b481db00b2c9eb3d5166d2164a0e388af410e21bd31b91f7008b9f37077729271d62604fe0f76b3f1d24ed4dd40ef8df2e6ed707fee4b35ce47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

Filesize
28KB

MD5
4cc15c6c89bf4ca952690d63fe59e670

SHA1
75c11485a8657fccc5d6f7c8759419190ed52018

SHA256
a44106763d8d3bce7f877a38c574d2075ed180d2fcc7c604e6750bc40df70fc9

SHA512
2b27a329fcc4387801539df0c98dcecfd52ab53d2f3fc97feb24f088194abb6e299debea0c051e63ad6e35c942ee1f49ab939676f28884e89b6072bc5503abd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
804ab943a55d5282bb8ebccc50f8b20c

SHA1
52c25e50ea192bcd5c62ba13dca8a55dc1ab5f36

SHA256
9660e3d44b7db1dd126e46cbe3c5f10c28796b9dbb6e117c0ccdc70678d40832

SHA512
3e53305a4a0b6d398abbd0b8f2d189fdb8a349871ed1cce97c186b734d53ea647f2754b964c2511826cbe57826dcbed13c377df481e8c6ce245e69d9c346a0ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
41b3e1efe955f581be7cddc3627c6927

SHA1
f2ba0dae3da294b5515842cc2f2a3cb1d2998c78

SHA256
d81579425316ae97bbc191c3c2e5730c928ad2570b39193088f55af3609dddde

SHA512
be631622e47b4510c67e2102d30e55430928043dad8585c6ead6316245802eaf719ac02f597c2cf36b16a75c300b452a208d2426df6f3f046d75a42dbc0df724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9ef0e140e04baa95d1b8f62776548dd

SHA1
7d702f0084b2244b062034f80bca5a9e56fc1ab6

SHA256
33af2006dc1a3fd01ea18c853759ede837f31644bc2a781ba3f68461ceea4d47

SHA512
6a1396c65ebcc2f61c7bc4d6719794f5416a7551111c50168e0ffd0a43e2fc572a855e3d7d1cc17f69201896012c14f8198573a32f5fabb2a307b337a04ff64d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a64e64c6b72baa6a2dee235d0d392390

SHA1
29c9988f56f62143389cc6c30a880e997c26e25c

SHA256
c423115c372817fbebfad11f1937da502b34d052943fe8a20adfcec0ec590859

SHA512
b509705cc7109c3f99773928662f48fcd9f23ae9e1c1a80f2c06384ccc0773f60b765aa34992c8cb61d60471735ca0382c40542c833a8df782fc9def4c70cbc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2f5f79460577d0af2f7e1d682cdaf50e

SHA1
5979889a0522c2aef483d3a8f55c269e7157bc0f

SHA256
a5576442f241dfdfafb72ba3eeccc9e15bbf3016e0cc34ea88b63044bc540893

SHA512
426540ddac4b2154bca1d98f1b0b55585f245bfb9ae2b389c1ed3678b2d6016a9b18e797d59a8cdc74f05fb5b28706568a0f5443de4cb67b32960a1f99eca048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e547fc80faed8b487a594822b4dfb046

SHA1
ccdc93d38999e60444453d035fb3dd7b39e3df8c

SHA256
e003609ea59f18fc11bfb3a3b8080ac96711f221f2fccb1b97cfc70045e37653

SHA512
50c626405fe3599f9fd02118438aae015c4688338b2cb1d137f013888973a19d401ad70d5c908acf7e488359d421a148cf4a5bb4fff00511fd3e61d7e8eff2d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c1082b86b5d7294a826a3e6aa78f57c

SHA1
c0be39d78e56bc85bae619ffc9455a1070be2a8d

SHA256
0b4e97e6168d3d8de7d1e0c9017b3b0c12f308f3f443d900491017854e9992fd

SHA512
d0d5a8b056a96b9e12648170234600b51649f732f6520449935a1f5aef1e3a2265ca44d36be3d1c0e3a9657e23f465115519ca366b237fc260b0744ac2d57252

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
8efadc1fd1a3c21bfb86156fa3cce145

SHA1
de36877b644653b3a222825e450dffa705edcd7e

SHA256
b89e3e721f5e72cc3b1e95d230c349031db22e478681a300434e6394c9bb8771

SHA512
d562cd04bb2e4e0ea3cbc86f4b5809fa7e12935149c27ff5af4f90c0615895ae98fb525d5d8d979620bedc084782de9ed5fef7381045092b0dc4388967f2c55e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
192d1fa0cf90ffea751208dfae687d71

SHA1
d49b4f727a76babc85097ab0c29405b0130268e2

SHA256
9773a604fd2f82cdfcbb74553222bd86e2b48ac5a576384745cf99c0c451278b

SHA512
63445c012e803bcb7da9b002fe077571e2dc0b6c0222baaca3526250aa25008a425ab7a0ce87b3da4fa0713beb68d394a203c8a97928d04a9533e836258e4cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b1ecca741cd30724bc6ee4cdd76ef025

SHA1
c972c0094d89da2d8b8d16b86307517683eb3182

SHA256
5f2720d331bb715a35d93650ee6d731dfb04f757df4d8df0695a3794f04e79b3

SHA512
015917ea85fbed96bf2b744959a794c074c98c51f4fc5867c355ce43c14844f0a4d73d792664fe1fd3d885b8e1d1d874692bbff2e4772392f912151eeb47122f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e196.TMP

Filesize
707B

MD5
e79782044d8810d060b80bcc4b717131

SHA1
16f6f4b75579f464a78670a3c4d5a44113af461b

SHA256
55344564d26870c0d47db17d2f60e4b8ab82f4ee81891bb958402c01163f9f6a

SHA512
cc5088c3195644110a7d684a74a2fc17ab9723a49a854fd10899f57fc61fadf0366f6018e32756a5408afd920f231c1a90021347582dc8bb2201d7fe14dcbe38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1dd3d8faede865bb9b53b270277da62d

SHA1
4b12761ba67a57771c20e726c73dcb702d9f2f4a

SHA256
abd5b27392ea4dba29963510fa0af6c253f58cd32579d8ab71ca312627b39f35

SHA512
f02d0ae29a25981e7f7b74abe0ecbe13858122c579aa8269bd4d3bcb2bdcc84222ab071373c13d139e8e0d2a7df8443ec28ba584dcca581d311ab20c1e368137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
0fa2395da11dfd9264b5ce58ad512cad

SHA1
9a0d5fa325b41de1ba2362c463e2041713d4fe64

SHA256
b7c11b3f679105857422eb60d0df1488eeddc58fa6420c9bff19017d4500b13a

SHA512
8ca2d65c63cb511da99fec0b620fee1f0945bb39daf54a63f181d167fba08e68669c4fba70a1d9b75523bf26dc6c957a13801bdbaf0939cefcec368af59eefc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
0050adc3da1d1aa579f2c899d6138f7c

SHA1
a44f5366415869748d3a5e439cfcb83e44fb4252

SHA256
1a0f70460e5e9bfbffe3666f07b002a97c41988a2d10178638f7dc588c31a187

SHA512
3d48eb48e1867c8be1467dc78e72f2e5546959a9ad922d8ebc7ee9d332af8ee7e7acdd87929285e546248cb29627bd9ff0e3484b98a71c685bfbd071a992733d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e8eb51096d6f6781456fef7df731d97

SHA1
ec2aaf851a618fb43c3d040a13a71997c25bda43

SHA256
96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

SHA512
0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aa4f31835d07347297d35862c9045f4a

SHA1
83e728008935d30f98e5480fba4fbccf10cefb05

SHA256
99c83bc5c531e49d4240700142f3425aba74e18ebcc23556be32238ffde9cce0

SHA512
ec3a4bee8335007b8753ae8ac42287f2b3bcbb258f7fc3fb15c9f8d3e611cb9bf6ae2d3034953286a34f753e9ec33f7495e064bab0e8c7fcedd75d6e5eb66629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
45f53352160cf0903c729c35c8edfdce

SHA1
b35a4d4fbaf2a3cc61e540fc03516dd70f3c34ab

SHA256
9cf18d157a858fc143a6de5c2dd3f618516a527b34478ac478d8c94ff027b0d2

SHA512
e3fa27a80a1df58acb49106c306dab22e5ed582f6b0cd7d9c3ef0a85e9f5919333257e88aa44f42a0e095fd577c9e12a02957a7845c0d109f821f32d8d3343f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
dc4dd6766dd68388d8733f1b729f87e9

SHA1
7b883d87afec5be3eff2088409cd1f57f877c756

SHA256
3407d8ad0c68a148aef81c7f124849573ac02097acd15f9bbe80f86e0498e826

SHA512
3084c1b7bb0fd998cddb8c917bac87f163a0f134a420158db4f354cb81ec1d5d65d3bac1d9b3e11b0a6707deacece47f819b1ed55ddf2b1d287fbdb244bf65a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
7d760ca2472bcb9fe9310090d91318ce

SHA1
cb316b8560b38ea16a17626e685d5a501cd31c4a

SHA256
5c362b53c4a4578d8b57c51e1eac15f7f3b2447e43e0dad5102ecd003d5b41d4

SHA512
141e8661d7348ebbc1f74f828df956a0c6e4cdb70f3b9d52623c9a30993bfd91da9ed7d8d284b84f173d3e6f47c876fb4a8295110895f44d97fd6cc4c5659c35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2ab9885ed803576dfcb4df976a3e7ca0

SHA1
49a54d1bb797dca76c41f6af288f9df6c705cf56

SHA256
9a7f8ca5a6bfcd5839a1cd029a116378bec3be1baec9db19bbe4f127199fb322

SHA512
b1f90e17c21425cd94a7f00438386ae40c7414784a96694432e340e35ba6a60e1176a2871a732474db4bd7080ebdbf4c476b61efa49fedf8208b382252ae25ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Arcane Cheat.exe

Filesize
1.7MB

MD5
593631a643aa6ab0af08189773812e6d

SHA1
6004dfe157f5be08b4591819bc7f76b5b12a08d9

SHA256
da0500db781ce974a0c4d9b6f245d2302f90dc932d23402d1441e3d5c77c6cd4

SHA512
057b00aa42a3b2da1dfaa646aa6bd0c8d9cdd3f34848f595b56aed2bf02f5d89092a7b2722bb24d3f860619fb305c994546ec6d43c6da1ef2fa82acc6cd5a643

Download Submit
C:\Users\Admin\AppData\Local\Temp\Arcane CheatSetup.exe

Filesize
44.8MB

MD5
81e98d594505e0008d35ff1e1d2e4e41

SHA1
d1852f516c8ffb87ca8a7e8146eafcd8d8a57369

SHA256
152dbb49fb78f6daa7ff14b44ea558e5164041cd7fe8a372e41a6d9f0d382512

SHA512
f9e4a531d5ba36d9924f0fa230bda219e17bacadc0c6a0e9a4f0cc96f96ff92a775cf33a5fd81291165fa36c0031d16efbdf8bb4c499e20ebbcd30e60e515930

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5idhnsdj.fpm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VRI8M.tmp\Arcane CheatSetup.tmp

Filesize
1.1MB

MD5
129b8e200a6e90e813080c9ce0474063

SHA1
b5352cdae50e5ddf3eb62f75f2e77042386b8841

SHA256
cf0018affdd0b7921f922f1741ad229ec52c8a7d6c2b19889a149e0cc24aa839

SHA512
10949e7f0b6dd55e0a5d97e4531ef61427920cccc2136c0dd3607cdc79afa0d8a7178965a07039948da97f0200ead8fe5a54921620c943c7fc76dd5ef5a7c841

Download Submit
C:\Users\Admin\Desktop\Arcane Cheat.exe

Filesize
46.5MB

MD5
236b78f3cd3a0b771d318f044dda8f45

SHA1
f890ca2ffb6218fa01df6844fe2a51b184e912b8

SHA256
8342c29aacd500b5d424822648331736379f18bdb6bc27a7e7a579544570fa8a

SHA512
8c6f2131f7566d64a5a8973cf4a3bad7d733e02d098326f30ec4f88785237c26d7361acfc674de084997356d2bb082ea8ec14b7ac4485fa63102b40c2dcb3d1e

Download Submit
C:\Users\Admin\Downloads\Arcane_Cheat.rar

Filesize
45.9MB

MD5
10ce87c51a7a139acafb11c8b74a3878

SHA1
a8d60630ff9fc1df44b5388b3701726b4b65ca0d

SHA256
2820ef6839738b1d19aebd920b008e51f70d1c60287f9b97aa6a60258ff3154f

SHA512
e1d17cb1ffb1a5909fc1b727e7ad555858b06c0cd38eb7d2060de263c131ce934548411597a4396869a955f7d15402cef712dad986cbee3424d4e8fad7120c7e

Download Submit
C:\Users\Admin\Downloads\Arcane_Cheat.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/840-512-0x0000000002C40000-0x0000000002C56000-memory.dmp

Filesize
88KB

Download
memory/840-511-0x0000000002C30000-0x0000000002C38000-memory.dmp

Filesize
32KB

Download
memory/840-520-0x000000001B6C0000-0x000000001B6CC000-memory.dmp

Filesize
48KB

Download
memory/840-515-0x000000001B6B0000-0x000000001B6BA000-memory.dmp

Filesize
40KB

Download
memory/840-514-0x0000000002C70000-0x0000000002C7E000-memory.dmp

Filesize
56KB

Download
memory/840-510-0x000000001B660000-0x000000001B6B0000-memory.dmp

Filesize
320KB

Download
memory/840-507-0x00000000007C0000-0x0000000000932000-memory.dmp

Filesize
1.4MB

Download
memory/840-513-0x0000000002C60000-0x0000000002C70000-memory.dmp

Filesize
64KB

Download
memory/840-508-0x0000000002AB0000-0x0000000002ABE000-memory.dmp

Filesize
56KB

Download
memory/840-509-0x0000000002C10000-0x0000000002C2C000-memory.dmp

Filesize
112KB

Download
memory/1052-567-0x00000241E5050000-0x00000241E5072000-memory.dmp

Filesize
136KB

Download
memory/1976-939-0x000000001D3E0000-0x000000001D908000-memory.dmp

Filesize
5.2MB

Download
memory/1976-794-0x000000001C9E0000-0x000000001CBA2000-memory.dmp

Filesize
1.8MB

Download
memory/2560-1234-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2560-1063-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2560-481-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3772-1232-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/3772-1064-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download
memory/4188-492-0x0000000000400000-0x0000000003281000-memory.dmp

Filesize
46.5MB

Download
memory/4516-1181-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/4896-1228-0x0000000001570000-0x0000000001571000-memory.dmp

Filesize
4KB

Download
memory/4896-1218-0x0000000001570000-0x0000000001571000-memory.dmp

Filesize
4KB

Download
memory/4896-1258-0x0000000001570000-0x0000000001571000-memory.dmp

Filesize
4KB

Download
memory/4896-1262-0x0000000001570000-0x0000000001571000-memory.dmp

Filesize
4KB

Download
memory/4896-1263-0x0000000001570000-0x0000000001571000-memory.dmp

Filesize
4KB

Download
memory/4896-1287-0x0000000001570000-0x0000000001571000-memory.dmp

Filesize
4KB

Download
memory/4896-1302-0x0000000001570000-0x0000000001571000-memory.dmp

Filesize
4KB

Download
memory/4896-1330-0x0000000001570000-0x0000000001571000-memory.dmp

Filesize
4KB

Download