hxxps://github[.]com/JackDoesMalwares/Gocullinator

Resubmissions

03/10/2024, 15:47

241003-s77adswhlg8

03/10/2024, 15:39

241003-s31l2ssgrr8

03/10/2024, 15:35

241003-s1stessgjn8

03/10/2024, 15:25

241003-strmsasdlp8

Analysis

max time kernel
519s
max time network
522s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03/10/2024, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/JackDoesMalwares/Gocullinator
Sample241003-strmsasdlp

Score

8^/10

bootkit defense_evasion discovery evasion exploit persistence privilege_escalation

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Holzer.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
9060	icacls.exe
5260	takeown.exe

Executes dropped EXE 1 IoCs

pid	Process
1800	Holzer.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5260	takeown.exe
9060	icacls.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
62	raw.githubusercontent.com
58	raw.githubusercontent.com
61	raw.githubusercontent.com

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
10276	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Holzer.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
10872	tasklist.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
11004	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\Holzer.exe:Zone.Identifier	firefox.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
11248	runas.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5324	6100	WerFault.exe	168
11148	10872	WerFault.exe	418
11140	10880	WerFault.exe	419
852	8648	WerFault.exe	611

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bthudtask.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certreq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CameraSettingsUIHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CertEnrollCtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Holzer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	backgroundTaskHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BackgroundTransferHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AtBroker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	auditpol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6316	PATHPING.EXE
8592	PING.EXE
11028	RpcPing.exe
10452	TRACERT.EXE

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	svchost.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
9920	timeout.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
8520	ipconfig.exe
6492	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
7560	systeminfo.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
9072	taskkill.exe

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	certreq.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-970747758-134341002-3585657277-1000\{AA1574B9-725A-4BA9-8892-1882E789B9B9}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	certreq.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	certreq.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	certreq.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	certreq.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	certreq.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	certreq.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	certreq.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	certreq.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	certreq.exe
Key created	\Registry\User\S-1-5-21-970747758-134341002-3585657277-1000_Classes\NotificationData	certreq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	certreq.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	certreq.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	certreq.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	certreq.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	certreq.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	certreq.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	certreq.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	certreq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	certreq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	certreq.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	certreq.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Holzer.exe:Zone.Identifier	firefox.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
8592	PING.EXE

Runs regedit.exe 2 IoCs

pid	Process
10816	regedit.exe
10852	regedit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1800	Holzer.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	3760	firefox.exe
Token: SeDebugPrivilege	3760	firefox.exe
Token: SeDebugPrivilege	3760	firefox.exe
Token: SeDebugPrivilege	3760	firefox.exe
Token: SeDebugPrivilege	3760	firefox.exe
Token: SeDebugPrivilege	3760	firefox.exe
Token: 33	4852	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4852	AUDIODG.EXE
Token: SeSystemtimePrivilege	1800	Holzer.exe
Token: SeSystemtimePrivilege	1800	Holzer.exe
Token: SeShutdownPrivilege	3712	svchost.exe
Token: SeShutdownPrivilege	3712	svchost.exe
Token: SeCreatePagefilePrivilege	3712	svchost.exe
Token: SeSecurityPrivilege	5072	auditpol.exe
Token: SeSystemtimePrivilege	1800	Holzer.exe
Token: SeSystemtimePrivilege	1800	Holzer.exe
Token: SeDebugPrivilege	4656	certreq.exe
Token: SeDebugPrivilege	4656	certreq.exe
Token: SeDebugPrivilege	4656	certreq.exe
Token: SeDebugPrivilege	4656	certreq.exe
Token: SeDebugPrivilege	4656	certreq.exe
Token: SeDebugPrivilege	4656	certreq.exe
Token: SeDebugPrivilege	4656	certreq.exe
Token: SeDebugPrivilege	4656	certreq.exe
Token: SeDebugPrivilege	4656	certreq.exe
Token: SeDebugPrivilege	4656	certreq.exe
Token: SeDebugPrivilege	4656	certreq.exe
Token: SeDebugPrivilege	4656	certreq.exe
Token: SeDebugPrivilege	4656	certreq.exe
Token: SeDebugPrivilege	4656	certreq.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3760	firefox.exe
3800	OpenWith.exe
4656	certreq.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 3760	3484	firefox.exe	78
PID 3484 wrote to memory of 3760	3484	firefox.exe	78
PID 3484 wrote to memory of 3760	3484	firefox.exe	78
PID 3484 wrote to memory of 3760	3484	firefox.exe	78
PID 3484 wrote to memory of 3760	3484	firefox.exe	78
PID 3484 wrote to memory of 3760	3484	firefox.exe	78
PID 3484 wrote to memory of 3760	3484	firefox.exe	78
PID 3484 wrote to memory of 3760	3484	firefox.exe	78
PID 3484 wrote to memory of 3760	3484	firefox.exe	78
PID 3484 wrote to memory of 3760	3484	firefox.exe	78
PID 3484 wrote to memory of 3760	3484	firefox.exe	78
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 4116	3760	firefox.exe	79
PID 3760 wrote to memory of 1548	3760	firefox.exe	80
PID 3760 wrote to memory of 1548	3760	firefox.exe	80
PID 3760 wrote to memory of 1548	3760	firefox.exe	80
PID 3760 wrote to memory of 1548	3760	firefox.exe	80
PID 3760 wrote to memory of 1548	3760	firefox.exe	80
PID 3760 wrote to memory of 1548	3760	firefox.exe	80
PID 3760 wrote to memory of 1548	3760	firefox.exe	80
PID 3760 wrote to memory of 1548	3760	firefox.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3052	attrib.exe

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/JackDoesMalwares/Gocullinator"
1⤵
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/JackDoesMalwares/Gocullinator
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1992 -parentBuildID 20240401114208 -prefsHandle 1920 -prefMapHandle 1912 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4f901b4-8da8-4b67-a8c3-e817742b9d9c} 3760 "\\.\pipe\gecko-crash-server-pipe.3760" gpu
    3⤵
    PID:4116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2408 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89f308c0-582c-424b-93b9-9f919efb790c} 3760 "\\.\pipe\gecko-crash-server-pipe.3760" socket
    3⤵
    PID:1548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3360 -childID 1 -isForBrowser -prefsHandle 3316 -prefMapHandle 3228 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8e08d65-83c9-48f0-a3ac-29a81ac67129} 3760 "\\.\pipe\gecko-crash-server-pipe.3760" tab
    3⤵
    PID:5016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3896 -childID 2 -isForBrowser -prefsHandle 3884 -prefMapHandle 3872 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f18617fd-ec78-4a79-8e0b-ad1b04aed10e} 3760 "\\.\pipe\gecko-crash-server-pipe.3760" tab
    3⤵
    PID:400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4756 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4720 -prefMapHandle 4704 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84b89f38-1935-469b-9091-c4a700261a74} 3760 "\\.\pipe\gecko-crash-server-pipe.3760" utility
    3⤵
    - Checks processor information in registry
    PID:2716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4780 -childID 3 -isForBrowser -prefsHandle 5324 -prefMapHandle 5356 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab03baea-a622-423d-9fcf-b0812ed55fa6} 3760 "\\.\pipe\gecko-crash-server-pipe.3760" tab
    3⤵
    PID:3820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5680 -childID 4 -isForBrowser -prefsHandle 5468 -prefMapHandle 5480 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f96803fc-7380-4b51-905f-eeb1d312d610} 3760 "\\.\pipe\gecko-crash-server-pipe.3760" tab
    3⤵
    PID:2044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5844 -childID 5 -isForBrowser -prefsHandle 5852 -prefMapHandle 5856 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cbd94b5-0374-4b8e-9b3e-6177ac9e3789} 3760 "\\.\pipe\gecko-crash-server-pipe.3760" tab
    3⤵
    PID:4704
- - C:\Users\Admin\Downloads\Holzer.exe
    "C:\Users\Admin\Downloads\Holzer.exe"
    3⤵
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1800
  - - C:\Windows\SysWOW64\agentactivationruntimestarter.exe
      "C:\Windows\System32\agentactivationruntimestarter.exe"
      4⤵
      PID:2080
  - - C:\Windows\SysWOW64\appidtel.exe
      "C:\Windows\System32\appidtel.exe"
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\ARP.EXE
      "C:\Windows\System32\ARP.EXE"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4668
  - - C:\Windows\SysWOW64\at.exe
      "C:\Windows\System32\at.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5100
  - - C:\Windows\SysWOW64\AtBroker.exe
      "C:\Windows\System32\AtBroker.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3800
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\System32\attrib.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3052
  - - C:\Windows\SysWOW64\auditpol.exe
      "C:\Windows\System32\auditpol.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5072
  - - C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\System32\autochk.exe"
      4⤵
      PID:5104
  - - C:\Windows\SysWOW64\backgroundTaskHost.exe
      "C:\Windows\System32\backgroundTaskHost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1408
  - - C:\Windows\SysWOW64\BackgroundTransferHost.exe
      "C:\Windows\System32\BackgroundTransferHost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5052
  - - C:\Windows\SysWOW64\bitsadmin.exe
      "C:\Windows\System32\bitsadmin.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4524
  - - C:\Windows\SysWOW64\bthudtask.exe
      "C:\Windows\System32\bthudtask.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1524
  - - C:\Windows\SysWOW64\ByteCodeGenerator.exe
      "C:\Windows\System32\ByteCodeGenerator.exe"
      4⤵
      PID:4320
  - - C:\Windows\SysWOW64\cacls.exe
      "C:\Windows\System32\cacls.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3408
  - - C:\Windows\SysWOW64\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1296
  - - C:\Windows\SysWOW64\CameraSettingsUIHost.exe
      "C:\Windows\System32\CameraSettingsUIHost.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:816
  - - C:\Windows\SysWOW64\CertEnrollCtrl.exe
      "C:\Windows\System32\CertEnrollCtrl.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1292
  - - C:\Windows\SysWOW64\certreq.exe
      "C:\Windows\System32\certreq.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4656
  - - C:\Windows\SysWOW64\certutil.exe
      "C:\Windows\System32\certutil.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1588
  - - C:\Windows\SysWOW64\charmap.exe
      "C:\Windows\System32\charmap.exe"
      4⤵
      PID:3704
  - - C:\Windows\SysWOW64\CheckNetIsolation.exe
      "C:\Windows\System32\CheckNetIsolation.exe"
      4⤵
      PID:4496
  - - C:\Windows\SysWOW64\chkdsk.exe
      "C:\Windows\System32\chkdsk.exe"
      4⤵
      PID:2432
  - - C:\Windows\SysWOW64\chkntfs.exe
      "C:\Windows\System32\chkntfs.exe"
      4⤵
      PID:4284
  - - C:\Windows\SysWOW64\choice.exe
      "C:\Windows\System32\choice.exe"
      4⤵
      PID:4320
  - - C:\Windows\SysWOW64\cipher.exe
      "C:\Windows\System32\cipher.exe"
      4⤵
      PID:4884
  - - C:\Windows\SysWOW64\cleanmgr.exe
      "C:\Windows\System32\cleanmgr.exe"
      4⤵
      PID:2860
  - - C:\Windows\SysWOW64\cliconfg.exe
      "C:\Windows\System32\cliconfg.exe"
      4⤵
      PID:5144
  - - C:\Windows\SysWOW64\clip.exe
      "C:\Windows\System32\clip.exe"
      4⤵
      PID:5160
  - - C:\Windows\SysWOW64\CloudNotifications.exe
      "C:\Windows\System32\CloudNotifications.exe"
      4⤵
      PID:5200
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:5240
  - - C:\Windows\SysWOW64\cmdkey.exe
      "C:\Windows\System32\cmdkey.exe"
      4⤵
      PID:5300
  - - C:\Windows\SysWOW64\cmdl32.exe
      "C:\Windows\System32\cmdl32.exe"
      4⤵
      PID:5348
  - - C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\System32\cmmon32.exe"
      4⤵
      PID:5368
  - - C:\Windows\SysWOW64\cmstp.exe
      "C:\Windows\System32\cmstp.exe"
      4⤵
      PID:5380
  - - C:\Windows\SysWOW64\colorcpl.exe
      "C:\Windows\System32\colorcpl.exe"
      4⤵
      PID:5400
  - - C:\Windows\SysWOW64\comp.exe
      "C:\Windows\System32\comp.exe"
      4⤵
      PID:5436
  - - C:\Windows\SysWOW64\compact.exe
      "C:\Windows\System32\compact.exe"
      4⤵
      PID:5480
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      "C:\Windows\System32\ComputerDefaults.exe"
      4⤵
      PID:5528
  - - C:\Windows\SysWOW64\control.exe
      "C:\Windows\System32\control.exe"
      4⤵
      PID:5584
  - - C:\Windows\SysWOW64\convert.exe
      "C:\Windows\System32\convert.exe"
      4⤵
      PID:5740
  - - C:\Windows\SysWOW64\CredentialUIBroker.exe
      "C:\Windows\System32\CredentialUIBroker.exe"
      4⤵
      PID:5852
  - - C:\Windows\SysWOW64\credwiz.exe
      "C:\Windows\System32\credwiz.exe"
      4⤵
      PID:5880
  - - C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\System32\cscript.exe"
      4⤵
      PID:5920
  - - C:\Windows\SysWOW64\ctfmon.exe
      "C:\Windows\System32\ctfmon.exe"
      4⤵
      PID:6100
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6100 -s 752
        5⤵
        Program crash
        
        PID:5324
  - - C:\Windows\SysWOW64\cttune.exe
      "C:\Windows\System32\cttune.exe"
      4⤵
      PID:1032
  - - C:\Windows\SysWOW64\cttunesvr.exe
      "C:\Windows\System32\cttunesvr.exe"
      4⤵
      PID:5360
  - - C:\Windows\SysWOW64\curl.exe
      "C:\Windows\System32\curl.exe"
      4⤵
      PID:5584
  - - C:\Windows\SysWOW64\dccw.exe
      "C:\Windows\System32\dccw.exe"
      4⤵
      PID:6032
  - - C:\Windows\SysWOW64\dcomcnfg.exe
      "C:\Windows\System32\dcomcnfg.exe"
      4⤵
      PID:6216
    - - C:\Windows\system32\mmc.exe
        
        C:\Windows\system32\mmc.exe C:\Windows\system32\comexp.msc
        5⤵
        
        PID:6240
  - - C:\Windows\SysWOW64\ddodiag.exe
      "C:\Windows\System32\ddodiag.exe"
      4⤵
      PID:6316
  - - C:\Windows\SysWOW64\DevicePairingWizard.exe
      "C:\Windows\System32\DevicePairingWizard.exe"
      4⤵
      PID:6408
  - - C:\Windows\SysWOW64\dfrgui.exe
      "C:\Windows\System32\dfrgui.exe"
      4⤵
      PID:6568
  - - C:\Windows\SysWOW64\dialer.exe
      "C:\Windows\System32\dialer.exe"
      4⤵
      PID:6744
  - - C:\Windows\SysWOW64\diskpart.exe
      "C:\Windows\System32\diskpart.exe"
      4⤵
      PID:6936
  - - C:\Windows\SysWOW64\diskperf.exe
      "C:\Windows\System32\diskperf.exe"
      4⤵
      PID:7040
  - - C:\Windows\SysWOW64\diskusage.exe
      "C:\Windows\System32\diskusage.exe"
      4⤵
      PID:6440
  - - C:\Windows\SysWOW64\Dism.exe
      "C:\Windows\System32\Dism.exe"
      4⤵
      PID:6388
  - - C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\System32\dllhost.exe"
      4⤵
      PID:7048
  - - C:\Windows\SysWOW64\dllhst3g.exe
      "C:\Windows\System32\dllhst3g.exe"
      4⤵
      PID:5224
  - - C:\Windows\SysWOW64\doskey.exe
      "C:\Windows\System32\doskey.exe"
      4⤵
      PID:5212
  - - C:\Windows\SysWOW64\dpapimig.exe
      "C:\Windows\System32\dpapimig.exe"
      4⤵
      PID:6568
  - - C:\Windows\SysWOW64\DpiScaling.exe
      "C:\Windows\System32\DpiScaling.exe"
      4⤵
      PID:6324
    - - C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe" ms-settings:display
        5⤵
        
        PID:6480
  - - C:\Windows\SysWOW64\driverquery.exe
      "C:\Windows\System32\driverquery.exe"
      4⤵
      PID:7360
  - - C:\Windows\SysWOW64\dtdump.exe
      "C:\Windows\System32\dtdump.exe"
      4⤵
      PID:7448
  - - C:\Windows\SysWOW64\dvdplay.exe
      "C:\Windows\System32\dvdplay.exe"
      4⤵
      PID:7580
    - - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
        
        /device:dvd
        5⤵
        
        PID:7596
      - C:\Windows\SysWOW64\unregmp2.exe
        
        "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
        6⤵
        
        PID:7640
        
        C:\Windows\system32\unregmp2.exe
        
        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
        7⤵
        
        PID:7704
  - - C:\Windows\SysWOW64\DWWIN.EXE
      "C:\Windows\System32\DWWIN.EXE"
      4⤵
      PID:7696
  - - C:\Windows\SysWOW64\dxdiag.exe
      "C:\Windows\System32\dxdiag.exe"
      4⤵
      PID:7888
  - - C:\Windows\SysWOW64\EaseOfAccessDialog.exe
      "C:\Windows\System32\EaseOfAccessDialog.exe"
      4⤵
      PID:8016
  - - C:\Windows\SysWOW64\edpnotify.exe
      "C:\Windows\System32\edpnotify.exe"
      4⤵
      PID:8032
  - - C:\Windows\SysWOW64\efsui.exe
      "C:\Windows\System32\efsui.exe"
      4⤵
      PID:8060
  - - C:\Windows\SysWOW64\EhStorAuthn.exe
      "C:\Windows\System32\EhStorAuthn.exe"
      4⤵
      PID:8076
  - - C:\Windows\SysWOW64\esentutl.exe
      "C:\Windows\System32\esentutl.exe"
      4⤵
      PID:8092
  - - C:\Windows\SysWOW64\eudcedit.exe
      "C:\Windows\System32\eudcedit.exe"
      4⤵
      PID:6728
  - - C:\Windows\SysWOW64\eventcreate.exe
      "C:\Windows\System32\eventcreate.exe"
      4⤵
      PID:7172
  - - C:\Windows\SysWOW64\eventvwr.exe
      "C:\Windows\System32\eventvwr.exe"
      4⤵
      PID:7236
    - - C:\Windows\SysWOW64\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"
        5⤵
        
        PID:7396
      - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\eventvwr.msc" "C:\Windows\system32\eventvwr.msc"
        6⤵
        
        PID:7484
  - - C:\Windows\SysWOW64\expand.exe
      "C:\Windows\System32\expand.exe"
      4⤵
      PID:7572
  - - C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      4⤵
      PID:7668
  - - C:\Windows\SysWOW64\extrac32.exe
      "C:\Windows\System32\extrac32.exe"
      4⤵
      PID:7920
  - - C:\Windows\SysWOW64\fc.exe
      "C:\Windows\System32\fc.exe"
      4⤵
      PID:7940
  - - C:\Windows\SysWOW64\find.exe
      "C:\Windows\System32\find.exe"
      4⤵
      PID:7752
  - - C:\Windows\SysWOW64\findstr.exe
      "C:\Windows\System32\findstr.exe"
      4⤵
      PID:7840
  - - C:\Windows\SysWOW64\finger.exe
      "C:\Windows\System32\finger.exe"
      4⤵
      PID:2432
  - - C:\Windows\SysWOW64\fixmapi.exe
      "C:\Windows\System32\fixmapi.exe"
      4⤵
      PID:8000
  - - C:\Windows\SysWOW64\fltMC.exe
      "C:\Windows\System32\fltMC.exe"
      4⤵
      PID:7720
  - - C:\Windows\SysWOW64\Fondue.exe
      "C:\Windows\System32\Fondue.exe"
      4⤵
      PID:8016
  - - C:\Windows\SysWOW64\fontview.exe
      "C:\Windows\System32\fontview.exe"
      4⤵
      PID:7416
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe"
      4⤵
      PID:5740
    - - C:\Windows\SysWOW64\cmd.exe
        
        /c echo "ApproveDeny.doc"
        5⤵
        
        PID:7672
  - - C:\Windows\SysWOW64\fsquirt.exe
      "C:\Windows\System32\fsquirt.exe"
      4⤵
      PID:8176
  - - C:\Windows\SysWOW64\fsutil.exe
      "C:\Windows\System32\fsutil.exe"
      4⤵
      PID:8144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument ftp://ftp.exe/
      4⤵
      PID:5788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffb77d33cb8,0x7ffb77d33cc8,0x7ffb77d33cd8
        5⤵
        
        PID:7320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,16969664999867716704,7030683202352837557,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2032 /prefetch:2
        5⤵
        
        PID:7824
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,16969664999867716704,7030683202352837557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
        5⤵
        
        PID:7772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,16969664999867716704,7030683202352837557,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
        5⤵
        
        PID:2432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16969664999867716704,7030683202352837557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
        5⤵
        
        PID:7968
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,16969664999867716704,7030683202352837557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
        5⤵
        
        PID:7704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2008,16969664999867716704,7030683202352837557,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3968 /prefetch:8
        5⤵
        
        PID:8304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,16969664999867716704,7030683202352837557,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1732 /prefetch:2
        5⤵
        
        PID:3128
  - - C:\Windows\SysWOW64\GameBarPresenceWriter.exe
      "C:\Windows\System32\GameBarPresenceWriter.exe"
      4⤵
      PID:7936
  - - C:\Windows\SysWOW64\GamePanel.exe
      "C:\Windows\System32\GamePanel.exe"
      4⤵
      PID:8392
  - - C:\Windows\SysWOW64\getmac.exe
      "C:\Windows\System32\getmac.exe"
      4⤵
      PID:8532
  - - C:\Windows\SysWOW64\gpresult.exe
      "C:\Windows\System32\gpresult.exe"
      4⤵
      PID:8628
  - - C:\Windows\SysWOW64\gpscript.exe
      "C:\Windows\System32\gpscript.exe"
      4⤵
      PID:8684
  - - C:\Windows\SysWOW64\gpupdate.exe
      "C:\Windows\System32\gpupdate.exe"
      4⤵
      PID:8724
  - - C:\Windows\SysWOW64\grpconv.exe
      "C:\Windows\System32\grpconv.exe"
      4⤵
      PID:8812
  - - C:\Windows\SysWOW64\hdwwiz.exe
      "C:\Windows\System32\hdwwiz.exe"
      4⤵
      PID:8920
  - - C:\Windows\SysWOW64\help.exe
      "C:\Windows\System32\help.exe"
      4⤵
      PID:8948
  - - C:\Windows\SysWOW64\hh.exe
      "C:\Windows\System32\hh.exe"
      4⤵
      PID:8988
  - - C:\Windows\SysWOW64\HOSTNAME.EXE
      "C:\Windows\System32\HOSTNAME.EXE"
      4⤵
      PID:9004
  - - C:\Windows\SysWOW64\icacls.exe
      "C:\Windows\System32\icacls.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:9060
  - - C:\Windows\SysWOW64\icsunattend.exe
      "C:\Windows\System32\icsunattend.exe"
      4⤵
      PID:9104
  - - C:\Windows\SysWOW64\ieUnatt.exe
      "C:\Windows\System32\ieUnatt.exe"
      4⤵
      PID:9148
  - - C:\Windows\SysWOW64\iexpress.exe
      "C:\Windows\System32\iexpress.exe"
      4⤵
      PID:9208
  - - C:\Windows\SysWOW64\InfDefaultInstall.exe
      "C:\Windows\System32\InfDefaultInstall.exe"
      4⤵
      PID:612
  - - C:\Windows\SysWOW64\InputSwitchToastHandler.exe
      "C:\Windows\System32\InputSwitchToastHandler.exe"
      4⤵
      PID:7408
  - - C:\Windows\SysWOW64\instnm.exe
      "C:\Windows\System32\instnm.exe"
      4⤵
      PID:8396
  - - C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\System32\ipconfig.exe"
      4⤵
      Gathers network information
      PID:8520
  - - C:\Windows\SysWOW64\iscsicli.exe
      "C:\Windows\System32\iscsicli.exe"
      4⤵
      PID:8544
  - - C:\Windows\SysWOW64\iscsicpl.exe
      "C:\Windows\System32\iscsicpl.exe"
      4⤵
      PID:7392
    - - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL iscsicpl.dll,,0
        5⤵
        
        PID:7388
  - - C:\Windows\SysWOW64\isoburn.exe
      "C:\Windows\System32\isoburn.exe"
      4⤵
      PID:8668
  - - C:\Windows\SysWOW64\ktmutil.exe
      "C:\Windows\System32\ktmutil.exe"
      4⤵
      PID:8716
  - - C:\Windows\SysWOW64\label.exe
      "C:\Windows\System32\label.exe"
      4⤵
      PID:8632
  - - C:\Windows\SysWOW64\LaunchTM.exe
      "C:\Windows\System32\LaunchTM.exe"
      4⤵
      PID:8600
    - - C:\Windows\SysWOW64\Taskmgr.exe
        
        "C:\Windows\System32\Taskmgr.exe"
        5⤵
        
        PID:8960
  - - C:\Windows\SysWOW64\LaunchWinApp.exe
      "C:\Windows\System32\LaunchWinApp.exe"
      4⤵
      PID:8988
  - - C:\Windows\SysWOW64\lodctr.exe
      "C:\Windows\System32\lodctr.exe"
      4⤵
      PID:8948
  - - C:\Windows\SysWOW64\logagent.exe
      "C:\Windows\System32\logagent.exe"
      4⤵
      PID:9004
  - - C:\Windows\SysWOW64\logman.exe
      "C:\Windows\System32\logman.exe"
      4⤵
      PID:9060
  - - C:\Windows\SysWOW64\Magnify.exe
      "C:\Windows\System32\Magnify.exe"
      4⤵
      PID:9160
  - - C:\Windows\SysWOW64\makecab.exe
      "C:\Windows\System32\makecab.exe"
      4⤵
      PID:8908
  - - C:\Windows\SysWOW64\mavinject.exe
      "C:\Windows\System32\mavinject.exe"
      4⤵
      PID:8452
  - - C:\Windows\SysWOW64\mcbuilder.exe
      "C:\Windows\System32\mcbuilder.exe"
      4⤵
      PID:8980
  - - C:\Windows\SysWOW64\mfpmp.exe
      "C:\Windows\System32\mfpmp.exe"
      4⤵
      PID:8484
  - - C:\Windows\SysWOW64\mmc.exe
      "C:\Windows\System32\mmc.exe"
      4⤵
      PID:8484
    - - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        5⤵
        
        PID:9236
  - - C:\Windows\SysWOW64\mmgaserver.exe
      "C:\Windows\System32\mmgaserver.exe"
      4⤵
      PID:9324
  - - C:\Windows\SysWOW64\mobsync.exe
      "C:\Windows\System32\mobsync.exe"
      4⤵
      PID:9420
  - - C:\Windows\SysWOW64\mountvol.exe
      "C:\Windows\System32\mountvol.exe"
      4⤵
      PID:9544
  - - C:\Windows\SysWOW64\MRINFO.EXE
      "C:\Windows\System32\MRINFO.EXE"
      4⤵
      PID:9612
  - - C:\Windows\SysWOW64\msdt.exe
      "C:\Windows\System32\msdt.exe"
      4⤵
      PID:9668
  - - C:\Windows\SysWOW64\msfeedssync.exe
      "C:\Windows\System32\msfeedssync.exe"
      4⤵
      PID:9732
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe"
      4⤵
      PID:9744
  - - C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe"
      4⤵
      PID:9808
  - - C:\Windows\SysWOW64\msinfo32.exe
      "C:\Windows\System32\msinfo32.exe"
      4⤵
      PID:9824
  - - C:\Windows\SysWOW64\msra.exe
      "C:\Windows\System32\msra.exe"
      4⤵
      PID:9868
    - - C:\Windows\system32\msra.exe
        
        "C:\Windows\system32\msra.exe"
        5⤵
        
        PID:9944
  - - C:\Windows\SysWOW64\mstsc.exe
      "C:\Windows\System32\mstsc.exe"
      4⤵
      PID:9972
    - - C:\Windows\system32\mstsc.exe
        
        "C:\Windows\System32\mstsc.exe"
        5⤵
        
        PID:9988
  - - C:\Windows\SysWOW64\mtstocom.exe
      "C:\Windows\System32\mtstocom.exe"
      4⤵
      PID:10044
  - - C:\Windows\SysWOW64\MuiUnattend.exe
      "C:\Windows\System32\MuiUnattend.exe"
      4⤵
      PID:10104
  - - C:\Windows\SysWOW64\ndadmin.exe
      "C:\Windows\System32\ndadmin.exe"
      4⤵
      PID:10168
  - - C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe"
      4⤵
      PID:10196
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1
        5⤵
        
        PID:9228
  - - C:\Windows\SysWOW64\net1.exe
      "C:\Windows\System32\net1.exe"
      4⤵
      PID:9596
  - - C:\Windows\SysWOW64\netbtugc.exe
      "C:\Windows\System32\netbtugc.exe"
      4⤵
      PID:8940
  - - C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe
      "C:\Windows\System32\NetCfgNotifyObjectHost.exe"
      4⤵
      PID:9780
  - - C:\Windows\SysWOW64\netiougc.exe
      "C:\Windows\System32\netiougc.exe"
      4⤵
      PID:9984
  - - C:\Windows\SysWOW64\Netplwiz.exe
      "C:\Windows\System32\Netplwiz.exe"
      4⤵
      PID:10160
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\System32\netsh.exe"
      4⤵
      PID:5748
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      "C:\Windows\System32\NETSTAT.EXE"
      4⤵
      Gathers network information
      PID:6492
  - - C:\Windows\SysWOW64\newdev.exe
      "C:\Windows\System32\newdev.exe"
      4⤵
      PID:9504
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:10144
  - - C:\Windows\SysWOW64\nslookup.exe
      "C:\Windows\System32\nslookup.exe"
      4⤵
      PID:10128
  - - C:\Windows\SysWOW64\ntprint.exe
      "C:\Windows\System32\ntprint.exe"
      4⤵
      PID:9680
  - - C:\Windows\SysWOW64\odbcad32.exe
      "C:\Windows\System32\odbcad32.exe"
      4⤵
      PID:6420
  - - C:\Windows\SysWOW64\odbcconf.exe
      "C:\Windows\System32\odbcconf.exe"
      4⤵
      PID:9548
  - - C:\Windows\SysWOW64\OneDriveSetup.exe
      "C:\Windows\System32\OneDriveSetup.exe"
      4⤵
      PID:10072
    - - C:\Windows\SysWOW64\OneDriveSetup.exe
        
        "C:\Windows\SysWOW64\OneDriveSetup.exe" C:\Windows\SysWOW64\OneDriveSetup.exe /permachine /childprocess /silent /renameReplaceOneDriveExe /renameReplaceODSUExe /cusid:S-1-5-21-970747758-134341002-3585657277-1000
        5⤵
        
        PID:10872
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10872 -s 1388
        6⤵
        Program crash
        
        PID:11148
    - - C:\Windows\SysWOW64\OneDriveSetup.exe
        
        C:\Windows\SysWOW64\OneDriveSetup.exe /peruser /childprocess /renameReplaceOneDriveExe /renameReplaceODSUExe
        5⤵
        
        PID:10880
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10880 -s 1444
        6⤵
        Program crash
        
        PID:11140
  - - C:\Windows\SysWOW64\openfiles.exe
      "C:\Windows\System32\openfiles.exe"
      4⤵
      PID:9556
  - - C:\Windows\SysWOW64\OpenWith.exe
      "C:\Windows\System32\OpenWith.exe"
      4⤵
      PID:9656
  - - C:\Windows\SysWOW64\OposHost.exe
      "C:\Windows\System32\OposHost.exe"
      4⤵
      PID:9768
  - - C:\Windows\SysWOW64\PackagedCWALauncher.exe
      "C:\Windows\System32\PackagedCWALauncher.exe"
      4⤵
      PID:9772
  - - C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe
      "C:\Windows\System32\PasswordOnWakeSettingFlyout.exe"
      4⤵
      PID:5792
  - - C:\Windows\SysWOW64\PATHPING.EXE
      "C:\Windows\System32\PATHPING.EXE"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:6316
  - - C:\Windows\SysWOW64\pcaui.exe
      "C:\Windows\System32\pcaui.exe"
      4⤵
      PID:8748
  - - C:\Windows\SysWOW64\perfhost.exe
      "C:\Windows\System32\perfhost.exe"
      4⤵
      PID:9612
  - - C:\Windows\SysWOW64\perfmon.exe
      "C:\Windows\System32\perfmon.exe"
      4⤵
      PID:9560
    - - C:\Windows\SysWOW64\mmc.exe
        
        "C:\Windows\system32\mmc.exe" "C:\Windows\system32\perfmon.msc" /32
        5⤵
        
        PID:7072
  - - C:\Windows\SysWOW64\PickerHost.exe
      "C:\Windows\System32\PickerHost.exe"
      4⤵
      PID:5792
  - - C:\Windows\SysWOW64\PING.EXE
      "C:\Windows\System32\PING.EXE"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:8592
  - - C:\Windows\SysWOW64\PkgMgr.exe
      "C:\Windows\System32\PkgMgr.exe"
      4⤵
      PID:6576
  - - C:\Windows\SysWOW64\poqexec.exe
      "C:\Windows\System32\poqexec.exe"
      4⤵
      PID:10268
  - - C:\Windows\SysWOW64\powercfg.exe
      "C:\Windows\System32\powercfg.exe"
      4⤵
      Power Settings
      PID:10276
  - - C:\Windows\SysWOW64\PresentationHost.exe
      "C:\Windows\System32\PresentationHost.exe"
      4⤵
      PID:10320
  - - C:\Windows\SysWOW64\prevhost.exe
      "C:\Windows\System32\prevhost.exe"
      4⤵
      PID:10384
  - - C:\Windows\SysWOW64\print.exe
      "C:\Windows\System32\print.exe"
      4⤵
      PID:10408
  - - C:\Windows\SysWOW64\printui.exe
      "C:\Windows\System32\printui.exe"
      4⤵
      PID:10456
  - - C:\Windows\SysWOW64\proquota.exe
      "C:\Windows\System32\proquota.exe"
      4⤵
      PID:10476
  - - C:\Windows\SysWOW64\provlaunch.exe
      "C:\Windows\System32\provlaunch.exe"
      4⤵
      PID:10492
  - - C:\Windows\SysWOW64\psr.exe
      "C:\Windows\System32\psr.exe"
      4⤵
      PID:10536
    - - C:\Windows\system32\psr.exe
        
        "C:\Windows\system32\psr.exe"
        5⤵
        
        PID:10576
  - - C:\Windows\SysWOW64\quickassist.exe
      "C:\Windows\System32\quickassist.exe"
      4⤵
      PID:10592
  - - C:\Windows\SysWOW64\rasautou.exe
      "C:\Windows\System32\rasautou.exe"
      4⤵
      PID:10660
  - - C:\Windows\SysWOW64\rasdial.exe
      "C:\Windows\System32\rasdial.exe"
      4⤵
      PID:10800
  - - C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\System32\raserver.exe"
      4⤵
      PID:10864
  - - C:\Windows\SysWOW64\rasphone.exe
      "C:\Windows\System32\rasphone.exe"
      4⤵
      PID:10996
  - - C:\Windows\SysWOW64\RdpSa.exe
      "C:\Windows\System32\RdpSa.exe"
      4⤵
      PID:11184
  - - C:\Windows\SysWOW64\RdpSaProxy.exe
      "C:\Windows\System32\RdpSaProxy.exe"
      4⤵
      PID:11260
    - - C:\Windows\SysWOW64\RdpSa.exe
        
        "C:\Windows\system32\RdpSa.exe"
        5⤵
        
        PID:10508
  - - C:\Windows\SysWOW64\RdpSaUacHelper.exe
      "C:\Windows\System32\RdpSaUacHelper.exe"
      4⤵
      PID:10444
  - - C:\Windows\SysWOW64\rdrleakdiag.exe
      "C:\Windows\System32\rdrleakdiag.exe"
      4⤵
      PID:3572
  - - C:\Windows\SysWOW64\ReAgentc.exe
      "C:\Windows\System32\ReAgentc.exe"
      4⤵
      PID:10520
  - - C:\Windows\SysWOW64\recover.exe
      "C:\Windows\System32\recover.exe"
      4⤵
      PID:8200
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe"
      4⤵
      PID:10748
  - - C:\Windows\SysWOW64\regedit.exe
      "C:\Windows\System32\regedit.exe"
      4⤵
      Runs regedit.exe
      PID:10816
  - - C:\Windows\SysWOW64\regedt32.exe
      "C:\Windows\System32\regedt32.exe"
      4⤵
      PID:10936
    - - C:\Windows\SysWOW64\regedit.exe
        
        "C:\Windows\regedit.exe"
        5⤵
        Runs regedit.exe
        
        PID:10852
  - - C:\Windows\SysWOW64\regini.exe
      "C:\Windows\System32\regini.exe"
      4⤵
      PID:10928
  - - C:\Windows\SysWOW64\Register-CimProvider.exe
      "C:\Windows\System32\Register-CimProvider.exe"
      4⤵
      PID:5280
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe"
      4⤵
      PID:11088
  - - C:\Windows\SysWOW64\rekeywiz.exe
      "C:\Windows\System32\rekeywiz.exe"
      4⤵
      PID:11060
  - - C:\Windows\SysWOW64\relog.exe
      "C:\Windows\System32\relog.exe"
      4⤵
      PID:1356
  - - C:\Windows\SysWOW64\replace.exe
      "C:\Windows\System32\replace.exe"
      4⤵
      PID:11144
  - - C:\Windows\SysWOW64\resmon.exe
      "C:\Windows\System32\resmon.exe"
      4⤵
      PID:11160
    - - C:\Windows\SysWOW64\perfmon.exe
        
        "C:\Windows\System32\perfmon.exe" /res
        5⤵
        
        PID:10920
      - C:\Windows\system32\perfmon.exe
        
        "C:\Windows\Sysnative\perfmon.exe" /res
        6⤵
        
        PID:10476
  - - C:\Windows\SysWOW64\RMActivate.exe
      "C:\Windows\System32\RMActivate.exe"
      4⤵
      PID:11148
  - - C:\Windows\SysWOW64\RMActivate_isv.exe
      "C:\Windows\System32\RMActivate_isv.exe"
      4⤵
      PID:8340
  - - C:\Windows\SysWOW64\RMActivate_ssp.exe
      "C:\Windows\System32\RMActivate_ssp.exe"
      4⤵
      PID:9444
  - - C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
      "C:\Windows\System32\RMActivate_ssp_isv.exe"
      4⤵
      PID:6012
  - - C:\Windows\SysWOW64\RmClient.exe
      "C:\Windows\System32\RmClient.exe"
      4⤵
      PID:8336
  - - C:\Windows\SysWOW64\Robocopy.exe
      "C:\Windows\System32\Robocopy.exe"
      4⤵
      PID:10768
  - - C:\Windows\SysWOW64\ROUTE.EXE
      "C:\Windows\System32\ROUTE.EXE"
      4⤵
      PID:10936
  - - C:\Windows\SysWOW64\RpcPing.exe
      "C:\Windows\System32\RpcPing.exe"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:11028
  - - C:\Windows\SysWOW64\rrinstaller.exe
      "C:\Windows\System32\rrinstaller.exe"
      4⤵
      PID:11040
  - - C:\Windows\SysWOW64\runas.exe
      "C:\Windows\System32\runas.exe"
      4⤵
      Access Token Manipulation: Create Process with Token
      PID:11248
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe"
      4⤵
      PID:5448
  - - C:\Windows\SysWOW64\RunLegacyCPLElevated.exe
      "C:\Windows\System32\RunLegacyCPLElevated.exe"
      4⤵
      PID:8764
  - - C:\Windows\SysWOW64\runonce.exe
      "C:\Windows\System32\runonce.exe"
      4⤵
      PID:5644
  - - C:\Windows\SysWOW64\sc.exe
      "C:\Windows\System32\sc.exe"
      4⤵
      Launches sc.exe
      PID:11004
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe"
      4⤵
      PID:10876
  - - C:\Windows\SysWOW64\sdbinst.exe
      "C:\Windows\System32\sdbinst.exe"
      4⤵
      PID:5032
  - - C:\Windows\SysWOW64\sdchange.exe
      "C:\Windows\System32\sdchange.exe"
      4⤵
      PID:3524
  - - C:\Windows\SysWOW64\sdiagnhost.exe
      "C:\Windows\System32\sdiagnhost.exe"
      4⤵
      PID:8304
  - - C:\Windows\SysWOW64\SearchFilterHost.exe
      "C:\Windows\System32\SearchFilterHost.exe"
      4⤵
      PID:10656
  - - C:\Windows\SysWOW64\SearchIndexer.exe
      "C:\Windows\System32\SearchIndexer.exe"
      4⤵
      PID:5508
  - - C:\Windows\SysWOW64\SearchProtocolHost.exe
      "C:\Windows\System32\SearchProtocolHost.exe"
      4⤵
      PID:6300
  - - C:\Windows\SysWOW64\SecEdit.exe
      "C:\Windows\System32\SecEdit.exe"
      4⤵
      PID:10512
  - - C:\Windows\SysWOW64\secinit.exe
      "C:\Windows\System32\secinit.exe"
      4⤵
      PID:10936
  - - C:\Windows\SysWOW64\sethc.exe
      "C:\Windows\System32\sethc.exe"
      4⤵
      PID:7044
  - - C:\Windows\SysWOW64\setup16.exe
      "C:\Windows\System32\setup16.exe"
      4⤵
      PID:10788
  - - C:\Windows\SysWOW64\setupugc.exe
      "C:\Windows\System32\setupugc.exe"
      4⤵
      PID:6796
  - - C:\Windows\SysWOW64\setx.exe
      "C:\Windows\System32\setx.exe"
      4⤵
      PID:11076
  - - C:\Windows\SysWOW64\sfc.exe
      "C:\Windows\System32\sfc.exe"
      4⤵
      PID:10772
  - - C:\Windows\SysWOW64\shrpubw.exe
      "C:\Windows\System32\shrpubw.exe"
      4⤵
      PID:8000
  - - C:\Windows\SysWOW64\shutdown.exe
      "C:\Windows\System32\shutdown.exe"
      4⤵
      PID:11108
  - - C:\Windows\SysWOW64\SndVol.exe
      "C:\Windows\System32\SndVol.exe"
      4⤵
      PID:8584
  - - C:\Windows\SysWOW64\sort.exe
      "C:\Windows\System32\sort.exe"
      4⤵
      PID:5924
  - - C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe
      "C:\Windows\System32\SpatialAudioLicenseSrv.exe"
      4⤵
      PID:7196
  - - C:\Windows\SysWOW64\srdelayed.exe
      "C:\Windows\System32\srdelayed.exe"
      4⤵
      PID:7188
  - - C:\Windows\SysWOW64\stordiag.exe
      "C:\Windows\System32\stordiag.exe"
      4⤵
      PID:6552
    - - C:\Windows\SYSTEM32\fltmc.exe
        
        "fltmc.exe" volumes
        5⤵
        
        PID:9080
    - - C:\Windows\SYSTEM32\fltmc.exe
        
        "fltmc.exe" instances
        5⤵
        
        PID:7256
    - - C:\Windows\SYSTEM32\fltmc.exe
        
        "fltmc.exe" filters
        5⤵
        
        PID:9876
  - - C:\Windows\SysWOW64\subst.exe
      "C:\Windows\System32\subst.exe"
      4⤵
      PID:5352
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\System32\svchost.exe"
      4⤵
      PID:3776
  - - C:\Windows\SysWOW64\sxstrace.exe
      "C:\Windows\System32\sxstrace.exe"
      4⤵
      PID:10680
  - - C:\Windows\SysWOW64\SyncHost.exe
      "C:\Windows\System32\SyncHost.exe"
      4⤵
      PID:480
  - - C:\Windows\SysWOW64\systeminfo.exe
      "C:\Windows\System32\systeminfo.exe"
      4⤵
      Gathers system information
      PID:7560
  - - C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe
      "C:\Windows\System32\SystemPropertiesAdvanced.exe"
      4⤵
      PID:6636
  - - C:\Windows\SysWOW64\SystemPropertiesComputerName.exe
      "C:\Windows\System32\SystemPropertiesComputerName.exe"
      4⤵
      PID:6704
  - - C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe
      "C:\Windows\System32\SystemPropertiesDataExecutionPrevention.exe"
      4⤵
      PID:1928
  - - C:\Windows\SysWOW64\SystemPropertiesHardware.exe
      "C:\Windows\System32\SystemPropertiesHardware.exe"
      4⤵
      PID:3188
  - - C:\Windows\SysWOW64\SystemPropertiesPerformance.exe
      "C:\Windows\System32\SystemPropertiesPerformance.exe"
      4⤵
      PID:10676
  - - C:\Windows\SysWOW64\SystemPropertiesProtection.exe
      "C:\Windows\System32\SystemPropertiesProtection.exe"
      4⤵
      PID:3056
  - - C:\Windows\SysWOW64\SystemPropertiesRemote.exe
      "C:\Windows\System32\SystemPropertiesRemote.exe"
      4⤵
      PID:8756
  - - C:\Windows\SysWOW64\SystemUWPLauncher.exe
      "C:\Windows\System32\SystemUWPLauncher.exe"
      4⤵
      PID:5152
  - - C:\Windows\SysWOW64\systray.exe
      "C:\Windows\System32\systray.exe"
      4⤵
      PID:9732
  - - C:\Windows\SysWOW64\takeown.exe
      "C:\Windows\System32\takeown.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5260
  - - C:\Windows\SysWOW64\TapiUnattend.exe
      "C:\Windows\System32\TapiUnattend.exe"
      4⤵
      PID:7884
  - - C:\Windows\SysWOW64\tar.exe
      "C:\Windows\System32\tar.exe"
      4⤵
      PID:8648
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\System32\taskkill.exe"
      4⤵
      Kills process with taskkill
      PID:9072
  - - C:\Windows\SysWOW64\tasklist.exe
      "C:\Windows\System32\tasklist.exe"
      4⤵
      Enumerates processes with tasklist
      PID:10872
  - - C:\Windows\SysWOW64\Taskmgr.exe
      "C:\Windows\System32\Taskmgr.exe"
      4⤵
      PID:7592
  - - C:\Windows\SysWOW64\tcmsetup.exe
      "C:\Windows\System32\tcmsetup.exe"
      4⤵
      PID:6776
  - - C:\Windows\SysWOW64\TCPSVCS.EXE
      "C:\Windows\System32\TCPSVCS.EXE"
      4⤵
      PID:10808
  - - C:\Windows\SysWOW64\ThumbnailExtractionHost.exe
      "C:\Windows\System32\ThumbnailExtractionHost.exe"
      4⤵
      PID:10936
  - - C:\Windows\SysWOW64\timeout.exe
      "C:\Windows\System32\timeout.exe"
      4⤵
      Delays execution with timeout.exe
      PID:9920
  - - C:\Windows\SysWOW64\TokenBrokerCookies.exe
      "C:\Windows\System32\TokenBrokerCookies.exe"
      4⤵
      PID:6704
  - - C:\Windows\SysWOW64\TpmInit.exe
      "C:\Windows\System32\TpmInit.exe"
      4⤵
      PID:9416
  - - C:\Windows\SysWOW64\TpmTool.exe
      "C:\Windows\System32\TpmTool.exe"
      4⤵
      PID:9608
  - - C:\Windows\SysWOW64\tracerpt.exe
      "C:\Windows\System32\tracerpt.exe"
      4⤵
      PID:10212
  - - C:\Windows\SysWOW64\TRACERT.EXE
      "C:\Windows\System32\TRACERT.EXE"
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:10452
  - - C:\Windows\SysWOW64\TSTheme.exe
      "C:\Windows\System32\TSTheme.exe"
      4⤵
      PID:10180
  - - C:\Windows\SysWOW64\TsWpfWrp.exe
      "C:\Windows\System32\TsWpfWrp.exe"
      4⤵
      PID:5392
  - - C:\Windows\SysWOW64\ttdinject.exe
      "C:\Windows\System32\ttdinject.exe"
      4⤵
      PID:6700
  - - C:\Windows\SysWOW64\tttracer.exe
      "C:\Windows\System32\tttracer.exe"
      4⤵
      PID:5176
  - - C:\Windows\SysWOW64\typeperf.exe
      "C:\Windows\System32\typeperf.exe"
      4⤵
      PID:5032
  - - C:\Windows\SysWOW64\tzutil.exe
      "C:\Windows\System32\tzutil.exe"
      4⤵
      PID:11068
  - - C:\Windows\SysWOW64\unlodctr.exe
      "C:\Windows\System32\unlodctr.exe"
      4⤵
      PID:10660
  - - C:\Windows\SysWOW64\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe"
      4⤵
      PID:9920
    - - C:\Windows\system32\unregmp2.exe
        
        "C:\Windows\SysNative\unregmp2.exe" /REENTRANT
        5⤵
        
        PID:10212
  - - C:\Windows\SysWOW64\upnpcont.exe
      "C:\Windows\System32\upnpcont.exe"
      4⤵
      PID:10908
  - - C:\Windows\SysWOW64\user.exe
      "C:\Windows\System32\user.exe"
      4⤵
      PID:6616
  - - C:\Windows\SysWOW64\UserAccountBroker.exe
      "C:\Windows\System32\UserAccountBroker.exe"
      4⤵
      PID:5620
  - - C:\Windows\SysWOW64\UserAccountControlSettings.exe
      "C:\Windows\System32\UserAccountControlSettings.exe"
      4⤵
      PID:2004
  - - C:\Windows\SysWOW64\userinit.exe
      "C:\Windows\System32\userinit.exe"
      4⤵
      PID:32
    - - C:\Windows\Explorer.EXE
        
        C:\Windows\Explorer.EXE
        5⤵
        
        PID:4192
  - - C:\Windows\SysWOW64\Utilman.exe
      "C:\Windows\System32\Utilman.exe"
      4⤵
      PID:4608
  - - C:\Windows\SysWOW64\verclsid.exe
      "C:\Windows\System32\verclsid.exe"
      4⤵
      PID:1172
  - - C:\Windows\SysWOW64\verifiergui.exe
      "C:\Windows\System32\verifiergui.exe"
      4⤵
      PID:3336
  - - C:\Windows\SysWOW64\w32tm.exe
      "C:\Windows\System32\w32tm.exe"
      4⤵
      PID:820
    - - C:\Windows\system32\w32tm.exe
        
        "C:\Windows\System32\w32tm.exe"
        5⤵
        
        PID:2824
  - - C:\Windows\SysWOW64\waitfor.exe
      "C:\Windows\System32\waitfor.exe"
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\wecutil.exe
      "C:\Windows\System32\wecutil.exe"
      4⤵
      PID:10528
  - - C:\Windows\SysWOW64\WerFault.exe
      "C:\Windows\System32\WerFault.exe"
      4⤵
      PID:5364
  - - C:\Windows\SysWOW64\WerFaultSecure.exe
      "C:\Windows\System32\WerFaultSecure.exe"
      4⤵
      PID:10600
  - - C:\Windows\SysWOW64\wermgr.exe
      "C:\Windows\System32\wermgr.exe"
      4⤵
      PID:1144
  - - C:\Windows\SysWOW64\wevtutil.exe
      "C:\Windows\System32\wevtutil.exe"
      4⤵
      PID:5552
  - - C:\Windows\SysWOW64\wextract.exe
      "C:\Windows\System32\wextract.exe"
      4⤵
      PID:2484
  - - C:\Windows\SysWOW64\where.exe
      "C:\Windows\System32\where.exe"
      4⤵
      PID:11124
  - - C:\Windows\SysWOW64\whoami.exe
      "C:\Windows\System32\whoami.exe"
      4⤵
      PID:10808
  - - C:\Windows\SysWOW64\wiaacmgr.exe
      "C:\Windows\System32\wiaacmgr.exe"
      4⤵
      PID:7560
  - - C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe
      "C:\Windows\System32\Windows.Media.BackgroundPlayback.exe"
      4⤵
      PID:10452
  - - C:\Windows\SysWOW64\Windows.WARP.JITService.exe
      "C:\Windows\System32\Windows.WARP.JITService.exe"
      4⤵
      PID:8648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8648 -s 236
        5⤵
        Program crash
        
        PID:852
  - - C:\Windows\SysWOW64\winrs.exe
      "C:\Windows\System32\winrs.exe"
      4⤵
      PID:7736
  - - C:\Windows\SysWOW64\winrshost.exe
      "C:\Windows\System32\winrshost.exe"
      4⤵
      PID:5624
  - - C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe
      "C:\Windows\System32\WinRTNetMUAHostServer.exe"
      4⤵
      PID:5696

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3800

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3992

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
PID:5796

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:5996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 6100 -ip 6100
1⤵
PID:4912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:6544
- C:\Windows\system32\dashost.exe
  dashost.exe {8f2c8669-9cc5-4f33-9d99fbe439020899}
  2⤵
  PID:6656
- C:\Windows\system32\dashost.exe
  dashost.exe {9a67948a-716e-46d4-bbf330c1b70c9faa}
  2⤵
  PID:6924
- C:\Windows\system32\dashost.exe
  dashost.exe {1b3af844-aeff-48a8-927c08dace1d9ffd}
  2⤵
  PID:6180

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
PID:6592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:6812

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:6904

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:7084

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:6276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k McpManagementServiceGroup
1⤵
PID:5960

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:7248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8444

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:9584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 10880 -ip 10880
1⤵
PID:11060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 10872 -ip 10872
1⤵
PID:11072

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{EA2C6B24-C590-457B-BAC8-4A0F9B13B5B8}
1⤵
PID:3564

C:\Windows\system32\utilman.exe
utilman.exe /debug
1⤵
PID:4692

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06C792F8-6212-4F39-BF70-E8C0AC965C23}
1⤵
PID:3324

C:\Windows\SysWOW64\wiaacmgr.exe
C:\Windows\SysWOW64\wiaacmgr.exe -Embedding
1⤵
PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 8648 -ip 8648
1⤵
PID:9884

C:\Windows\System32\wiawow64.exe
C:\Windows\System32\wiawow64.exe -Embedding
1⤵
PID:8576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9a6fad9913a30e0476c200ab13f96c2c_99ef8723-b5cb-4d6a-b7a3-7e98e5e6f2a8

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\9a6fad9913a30e0476c200ab13f96c2c_99ef8723-b5cb-4d6a-b7a3-7e98e5e6f2a8
Size 106B
SHA256 4d0d8cbc6fb59c8e081349f09f3f82e65540b64b50969e4cea5948624fbec604
MD5 666ea65934b820274adc4c5c344bff32
SHA1 d23a25d65fa435eb01c6de837656a8d61a58620f
SHA512 bb2eed9cf9b508711acb566f180cd329e4b0c7de7acb9a614e25d866b683f6e297675c025dc3910176816202aaf12749411112dc42059fbf5f15fa8929accc37
MD5 SHA1 SHA512

Submit Download

9a6fad9913a30e0476c200ab13f96c2c_99ef8723-b5cb-4d6a-b7a3-7e98e5e6f2a8

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\9a6fad9913a30e0476c200ab13f96c2c_99ef8723-b5cb-4d6a-b7a3-7e98e5e6f2a8
Size 2KB
SHA256 14b3f481d35450e9638e0777f39a041a0e6c372c1f0d1a4c0ac5668c67deebe8
MD5 de9c37ebc68009a25fd9c68a3be80d43
SHA1 ec0e281208599e01f94b4e9c9ed5bfbd8bd59990
SHA512 999098db86ab487a83300fc14f96b93de6d5264b53d92eeaff207b7379162a26f0789938b60fb58b34405411db08df10acf40f5eee97ff3fcf8020a2c1de3a5f
MD5 SHA1 SHA512

Submit Download

CERT-Machine-2048.drm

Path C:\ProgramData\Microsoft\DRM\Server\S-1-5-21-970747758-134341002-3585657277-1000\CERT-Machine-2048.drm
Size 28KB
SHA256 dfc1a228efa1909380bc6a6ba4d6d9d0c252b3fa42be0c74ce744cfcb833e064
MD5 0a4d68adf3f5f4f034f196486623a15d
SHA1 c8b72ffb8e686db3eb8eb194484748f5836780ec
SHA512 e63980a65c779a442aa54e451e6d8c64ec1a9685a0f872c931a027ee13cd77db954109167a1c3c6e28e565e67e8fd1644d31b2a1e892fa421ee510402704dfb9
SSDEEP 384:5soFxaAa93IGRZ5oF7XCKb95GR1K801fKFSXX3OTKk:deb9/IpXhBU1K8ufKFSXX3OTKk
MD5 SHA1 SHA512 SSDEEP

Submit Download

CERT-Machine.drm

Path C:\ProgramData\Microsoft\DRM\Server\S-1-5-21-970747758-134341002-3585657277-1000\CERT-Machine.drm
Size 25KB
SHA256 629f69a8474084f169a9883b1a7842d3859f4dc99711297fc2988bb3c393ed4f
MD5 d6a0117695b6b9ca261a2cf718412ae3
SHA1 4134bb84ef4e38c206ee45e50e6315239c0bb9df
SHA512 9159cc0bd9e9b04c4afd37bde683612bcaf41d8dc81e5aa68b4a13d558f65d25ed110ddca4a3acda1896e8a1fe5add3b7d68bc86931b9b6a57b5aecbfbbe49e5
SSDEEP 384:5AW9NaAmO+1W9tft0AODyKx0SKl73qPKoLt:Sal0gKx0SKl73qPKEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 338B
SHA256 51b9f182f48639cd9db8eb63d447842a932223f2ff9227f24aa60b4893bcf8b2
MD5 ab1dac5515bf0a05daf86ee858dc074d
SHA1 4ed9a5502533419df4284122cd663c269b1ae874
SHA512 657398763990d1d347cb22772cd3f680bf4089fdbdf16c220ffb88bc1e38936fee9a2198ea9154719a1a86d2a45f373b492e75d48f16209b557dcb8a523ee771
MD5 SHA1 SHA512

Submit Download

CERT-Machine-2048.drm

Path C:\Users\Admin\AppData\Local\Microsoft\DRM\CERT-Machine-2048.drm
Size 28KB
SHA256 d0cdc3c4ee6015cf64d602c297ff2fd779a5b9ad50d00e99cf73f87ad45fa53c
MD5 2600ec4ed8d7b523bb33b773b31a7320
SHA1 6df88ebeeea513802690d610328fbf41c3bda227
SHA512 081ee419a5486f4fe609d2d3f6c3f335294fd34aa6b67b75b398023b7e7e07ac1a3222e2c4ab03a245206705116cc8a8af6c5ce1212d759600db2457ce7d30f0
SSDEEP 384:2AOHOrtHeaJcSAOLiMtHeaJcgK3E2ZpeZKIqTFX3OTKk:9JcWhJcgK3rZOKIqTFX3OTKk
MD5 SHA1 SHA512 SSDEEP

Submit Download

CERT-Machine.drm

Path C:\Users\Admin\AppData\Local\Microsoft\DRM\CERT-Machine.drm
Size 25KB
SHA256 b3566ee1acd85594e5e46ba431a53aec10027474ca0482848a2d1c58c8b3dc34
MD5 730e9e6b157b3fc400acda6e2c5a442f
SHA1 49d86eb71df09098f4a72aea3169c3901aa09f37
SHA512 2634bf858f5885787506bd75b29faef99b219ea9ae883777475e73bee14fbabee28a771e359e2bf748a0f9fa41d2f252a3778b0bfa8173e1a78eba52e3fdf5de
SSDEEP 384:213F/wDr5yrrN3QQT13F/wRX1rN3QQyKQWWKxf73qPKoLt:yaBeQQxaxTQQyKQWWKJ73qPKEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e
MD5 058032c530b52781582253cb245aa731
SHA1 7ca26280e1bfefe40e53e64345a0d795b5303fab
SHA512 77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da
MD5 a8276eab0f8f0c0bb325b5b8c329f64f
SHA1 8ce681e4056936ca8ccd6f487e7cd7cccbae538b
SHA512 42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3ee0068f52bbc41670faea1863b844d6e8947bddbcc18f11ad0e329e66ad1664
MD5 d359fc87a72a204ef3e8d2c653151960
SHA1 9a72efe7dd852b8d38d310efcfc10cbc5e991be9
SHA512 7e6b9050fcc3587e930426c95aca4467e986570f8c0a878f035d51a85d1d88dd75b6890d2ba4bb5880bcde1a7736b16bd07ba1430b928c39a67838e56d982d1c
SSDEEP 96:nsk3nv8N2kIAzwSv0MoiVmdHIAJf2cL0WQyV+VuziX3wI3:nsk3vu2kIAzv0MAI2fxLLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5f3b369697453e0a22c5c3ddd803704b1cdfaa4dc9e69e7776097e8a80819221
MD5 25917f3d8e5b0107657d275b89f13466
SHA1 82d42c8e9d39042645674eabd45f8d1a254872b3
SHA512 27744448b220696b8439b420d34d1db5199e1b344692baf6411f39cc7655e924a296ac2d0a592186d3f533324274d6e8e78386d2fa79f7e79fc32ed583f20b84
SSDEEP 96:nsk3ZOsQ/8N2kIAzwSv0MoiVmdHIAJd2cL0WQyV+VuAiX3wI3:nsk3+u2kIAzv0MAI2dxLLH93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 14002e3249721af094c1d6785abc9bec7c0213d23de79aef8378a6b3cf6eadcc
MD5 b488ebdfe805dde8d86d842a1bbab9a3
SHA1 aee05ac83be6599c32adb35114b2f71f5681b702
SHA512 1bf13216ae18cd09c5479443e87300fe4989eb09197095874e7b11751769bb47565a2e24492a5686f9696a23c32088ea404ead486a0b45817d09eaa608a86aef
SSDEEP 192:1moCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3oNIWlze2RU7URsmqoqHaZYU:1i9iIxuERzA83h09RZxA3CbCNoqHGYU
MD5 SHA1 SHA512 SSDEEP

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 768KB
SHA256 2143b38a332f1498bd717bf10e22390cb6f8e1d90a6e89a8b555fa6d1198df66
MD5 d0fd2204de0ac29061e7314ee45b0bfa
SHA1 471ff9a39c0a4fc814844153bf4a368eec952433
SHA512 1bf4e2b85ade5bad92ba1e467469059bb0001870adca11f065edf52ea4cd7cae02e578b21d184d9f3965a6ad619cc7e1c65110a37d204573d0dff79d20c63141
SSDEEP 768:Af0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr3UzfEwPRzitFrzAqUmNKX09oJImX:ANpZoOYpktMhKSo/oGXr1Yl+
MD5 SHA1 SHA512 SSDEEP

Submit Download

DeviceHealthSummaryConfiguration.ini

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
Size 69B
SHA256 3bc4df39d8cd1ae6d79bfcc522bc8cab561908cc8bb107bfed35e1128e0329e0
MD5 52c9473193b9bddc1572ae9277c16a01
SHA1 a8a83b1fc37e4cbe1f68b104fb1c1b0f00f8927e
SHA512 b2e5361592912f9f223000c9846c59ebc25cee95449ecf776dc89d52dc06d03a130665ac622f779ae617fc2963158dbc97ec0843b73e477e94bfe03d705bff1d
MD5 SHA1 SHA512

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\activity-stream.discovery_stream.json
Size 18KB
SHA256 0bf0b9985a4eb09ef7cf97fec02a5f44efc28b2c5c1900b1582845687f0dbea5
MD5 a205c9b0f926aacc0ffbb6e5db61ca63
SHA1 a86c60df3b391f55e08111ac88e36011dd93a179
SHA512 f5efaa86c6b69d505b213f299193ea3a10298eb277956371998af3831052f9be0b69d63afea944e25ab6afba3e4ca7d48688abb5878dde2e3fd9ba5fdbc01cc2
SSDEEP 384:It2FKkXBL5nT+cQkXXdX0Lcgpb/+fYXcdzfcLNQM4nyaE:ItgK0d+cQbLc8/vwfiNCyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\cache2\entries\0305BF7FE660AF5F32B4319E4C7EF7A7B70257A3
Size 13KB
SHA256 f16f21f18be974b2d55b4a03cd47a1d6883ae977f84f89581a41814bb1eacb9f
MD5 3f3901416c07f41fd63b8e4eed090451
SHA1 a89cbcee7d2dc409e54ca4bdd2b3cfdf1d409f69
SHA512 0d3ffea8601ffda917fbad9af7f00c7e65c1fe37aad15dd6bd65aaebe8ac441c3a55c413f336b0c015ab7f6aa8e88fc416d2a9d7d5e0ecacb3fd5f9a1a48a042
SSDEEP 384:H7C9Du9fiGLm4pUIpHLFoCr/E8HPJyD3VonFcP+AWRMAC4zFhkzFhK:bbBi8mCUIpHLGCr/E8Rg3V/+hRMF4oW
MD5 SHA1 SHA512 SSDEEP

Submit Download

22386449CA13D8975B935875780066C6EF52CE37

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\cache2\entries\22386449CA13D8975B935875780066C6EF52CE37
Size 13KB
SHA256 de7a75b3fa4f75ae23d7b942f7f21e8ec542429bcb837ca1a63a970d175ac63f
MD5 35bf371c3ded7b5f80f6c05a2c982d83
SHA1 7e43073e8080be6cb9f943e3ade49b4feb60afaa
SHA512 7790bc8c9d19af117b383e3c41f407f027d19a2018a783e3211be6c6c246504698ff34ae7bbb6513e008bde0582c7bf33dc98836b4cfe3a5b18017ec0799a78e
SSDEEP 384:HiWu9fiGLm4pUjpHLFoCr/E8HPJyD3VonFcP+AWRMACepMSpMm:iBi8mCUjpHLGCr/E8Rg3V/+hRMFa
MD5 SHA1 SHA512 SSDEEP

Submit Download

6D89348819C8881868053197CA0754F36784BF5F

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F
Size 15KB
SHA256 ea00cd7dc22e2cd8448d9bc3388fbddb88f098e5237e7421a4a94c4f5f89b7f4
MD5 4af193b60820d64144b9cf3bae4a1c6a
SHA1 daed69f0ceb1b20049f0d0604fd7ca64dbccab37
SHA512 fde2fbe419f4c691de235f774f474be855d08f1ed6b386d63f79ba2c5c4b8ea2e8308ab51637a326830b8baca2df60abd87dd752f04309ae3278b3ffb977235e
SSDEEP 384:pjxJAiTbUv32QECOHg8fmfyZB7t0lpDIIfnG:vWL39ECeg8fmfIB7eD89
MD5 SHA1 SHA512 SSDEEP

Submit Download

5_EUibGBtE1cWaOjHYogj0xa0h2u9gU0PvprH9KF0J0=.ico

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\jumpListCache\5_EUibGBtE1cWaOjHYogj0xa0h2u9gU0PvprH9KF0J0=.ico
Size 25KB
SHA256 92c62d192e956e966fd01a0c1f721d241b9b6f256b308a2be06187a7b925f9e0
MD5 6b120367fa9e50d6f91f30601ee58bb3
SHA1 9a32726e2496f78ef54f91954836b31b9a0faa50
SHA512 c8d55a2c10a2ef484dedded911b8f3c2f5ecb996be6f6f425c5bd4b4f53eb620a2baccd48bac1915a81da9a792971d95ff36c3f216075d93e5fd7a462ecd784f
SSDEEP 768:CzDUwDsh9y+lOGi3ya3zoogw3MHDbU3liHY:CEwra5ja3tf3MHDNY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resmon.ResmonCfg

Path C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
Size 17B
SHA256 568269850dbb3f5f52e0e38e3c0b29be06c70c58fe425b39746f5ccefdd668a4
MD5 407aab8c27cf7081eece071c90a65b83
SHA1 d9ec9f9d3768fb1c3646284d77f519f74ee6b8cc
SHA512 88a35933e87dbdd298577bdb33afb1f878dc68f43e7916c4102e893fe04812a9522ed66755df03105fd199fdc3c6bd197051c22b2ea2765d0adba5c375ddd35c
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_zpc4d2rx.qvc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zpc4d2rx.qvc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 4d746ffaba7dedb97a18fe0d17287b5363e4b13d7d108f3f3a7c95bfdbb16cdc
MD5 d907ae181b4304fd35b69481c8d49ab8
SHA1 2fd13fcd8aaa3790d8617fc9aca5158616a83f71
SHA512 4e0df72f934769a24351dd8b8da615b0abf6f7b115217d16188d9b344b2a4594ca4d7997893310ebb7c04d39a9060e69f668ad1176c6e1142efebfa4f459a90a
MD5 SHA1 SHA512

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 b8401d2b0e9b8f5f6ecb53c7d9b0496345de1120508e136a98fdfedb08cd4e08
MD5 4f24c5ff55d3b042ff310bc9b3587c2a
SHA1 89656d51dc7ab9be2d6a318c9f56109e3e2e6dda
SHA512 214927dbe5e002451c6a62133bcdd7439502e060b596bb2516518b0d8e1b80327e07fbaa84afa3cc7fe7a2bfd5457a3122d2558159a2ae30ea77cd8d860e9421
MD5 SHA1 SHA512

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 9KB
SHA256 ccc9600c691dfa5c3bfa1f86b4ef214a4a56efc3710854e8bf8d329dcb96427d
MD5 bed12a9a5311fd5a2cda9cac8fe5ce2c
SHA1 5c292f0b1c50b71927ba6de4cfd8d8c24ceb3d2c
SHA512 5945f3227f032e58fab9df5361df4614d041cb0492e157bde9c5b735474d24b76a3ee0fe8853aa9df491d63f38b3564bffbc43eee0026ac142a4fe339709389e
SSDEEP 48:R2dqJ5UgdwseXzaRd57J/6BdwseRQRd57J/adwsezDZ0Rd57JmWFuSvWo3dwsex2:Rhj/O/6mE+aZB5F
MD5 SHA1 SHA512 SSDEEP

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 9KB
SHA256 35d3fd1d5f22ce3e671251a10d23a23d0858b18d1967b29f7d9f4249d6cd649d
MD5 80ad795b95657dad8598f79e5dec28bc
SHA1 6709737c0c7d14ae89b586c2142e0213e64c87c3
SHA512 44744d03a371691b916339f798a2603e2b43ebbc8c1d6bd2f72f867e5e5959a38844a7d4ef3f976c9537e5d5a310e66a1d8d7da2e220bff5fc18b5ee75ea190b
SSDEEP 48:giRd5wJ5UgdwseXzxRd5wJ/6BdwseRXRd5wJ/adwsezD20Rd5wJmWFuSvWo3dwsl:gXN/Q/kmE+EZB5F
MD5 SHA1 SHA512 SSDEEP

Submit Download

AMD5BAJCGYLPV1WGKGT0.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AMD5BAJCGYLPV1WGKGT0.temp
Size 9KB
SHA256 f550b216d09bfc33fa56186a92036be8fe771fefd1e2a8feb4fb710602f9b5c2
MD5 11778686476d3c860cd944345d7046d3
SHA1 51c66aee3b9294feecf0375dc70d15bde2f1bd29
SHA512 fcc95b9c8850e6c1412856bbd9c9ec29e7a60997ff31b85211ea48719f1cf730151c801b7b2b034cacd5d887903b30e5bda41f9163e9ab3fab67045021d5e934
SSDEEP 48:R2dqJ5UgdwseXzOdqJ/6BdwseR4dqJ/adwsezDZsdqJmWFuSvWo3dwsexWFzcdqf:RhG/z/HmE+CZBE9+F
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\AlternateServices.bin
Size 6KB
SHA256 0d5c2ef1b91e6d9b9d02b29366023a2d12c2be4c5a0bf90da1c5b02cfce754df
MD5 5717a70c26c34f1528368556fb1c0010
SHA1 5bd6679a0a93dd1baad51de05944b46c6de130c6
SHA512 5ff3d1e92f59b1e3dbaa556cbb97d4b14d15eb8e07456557a0537799eef8134720006aea8e8748bbb95803838818223464105b4252ab8247fc510db3619d0113
SSDEEP 24:9WuB1oYUCFsh2F3LFOgu1xgRbtspR5cOOluhMZr4:3K5oRs9cOO
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 98a95e813d03c086aa2832c2a2724719f5097ccc41083d1c43a390db20752ffc
MD5 a56ceec811118ab8266556c74d14bf47
SHA1 44e666ad44934ff7375d34dc9b7e2a3f31733dff
SHA512 17d4b8071b6d6ae7acb987c9bec36f5598434893c99e69cda504e317f35e5753566ead1bdc9237df7bf1239bd04a2f6d539c165a8bf8a91463bbdcd88f394fdd
SSDEEP 96:b/QcMFl66Joz0dzgClKtmSSz1BfSMF9ZbkW6QX0BBQhmrGPP/PhxkW3:g/66Joz0dzgCl6mSSTrvZboHQhSoPDf3
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Size 38KB
SHA256 bd0f53a93f4193ffa245d8a8d6d8c9bb3a8ae81a5a56343c33d134e4ce32afdf
MD5 f474b50d79c114854d3b551a123d0822
SHA1 ca4d4c70ddcd087324d48d8f0a3fd47cb998adc6
SHA512 7de38ddad7a908bf78b3a0b3a5b78fd23316a21f8f17e9c86882f2d109b78ebe70b4d2018b7bee08c62a2e785fa7ef6af735731f4b488762078a2e253b69b543
SSDEEP 768:9hcmuBskRAuMe3sD48OxP9Y+Qt8Aylnj4kq8/8gKb+bmbWbkb8b/bjb9yOjoXbXe:CBskRAuMe3i48q/Qt3yyOjoXbXoE6h/
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 ceb86511e5f57275d27892b485808d377eb396de4499ae6b1bebc8ca89de0478
MD5 1c2395efa4c4d3bbeee8b0995947df22
SHA1 f8a96f4d43993569076daacf5561e0b1d3ac549c
SHA512 4b71fc4eefb3f6d24af32bb62098acf10e9f75af3ab5595b43d3a75b36bd7fbaa0fc137e52f9b489b560f2a862c4904ec738ba385108ff58ccf3864df480f057
SSDEEP 96:b/QcMFl66Joz0dzgClKtmSSbBfSMF9ZbkW6QX0BBQhmrGPP/PrWI:g/66Joz0dzgCl6mSS1rvZboHQhSoPCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 c6d869f3237aa7103e2539c99c29c03a1b6a6a7b149c2f47e840690499510ea4
MD5 8ef063c09ce1fcaa9df89ce884ca438b
SHA1 c9a10fe41cf5b64ef86698e00d55b4a5c1be1fb3
SHA512 073ee861078da4fe7091bb3ed5ee79ff8b8fb866cd0ccca8941a2e502e603df7342f186cc00bccaaf2a684b64089bbb4474d5cca37c1b340a9dbf275e372b00e
SSDEEP 96:ZSMF9ZbkW6QXyhmrGPP/PrWZb/QcMFl66Joz0dzgClKtmSS:ZrvZboVhSoPCi/66Joz0dzgCl6mSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp
Size 15KB
SHA256 3773570833b9cc7ec0ebbe20b9a6f855955e66afd8659c01d58fd24c45b8658e
MD5 509a38200a49f1dde4bda5946349e190
SHA1 bb9c7e47c0c599ab3e66fca167e673ca82012f8d
SHA512 611fc9427d368f51a49cf0305f66f9550618372ab068975226418a20b4b3a0d4bfb61f027e725862ca7cb54d7764f50ae2e8e6a8fd666fcb5238dd8625cfd9c9
SSDEEP 384:4RUSDEP/D2MrHbAbXI/66JozQzgC1bebowb9Pr:mvA/D2MrHbAbX1mABz
MD5 SHA1 SHA512 SSDEEP

Submit Download

30ce2edc-cf62-40a1-a178-d915df9066f6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\30ce2edc-cf62-40a1-a178-d915df9066f6
Size 982B
SHA256 081e5bb44a202557465171cce2bfa8e712e43bbc20486a51d2c6c78bae9f180f
MD5 90d2580fca12a4af4d541f3004962989
SHA1 97c865948fb6f8e47dd8f216e9529967634550f2
SHA512 f8978f2eb7d142079d36a82d9fb75d503246a4113b7ef6d648e2521ddc9950b80f9ef3f1e95154bebb70cd7a26a4531eddd9c8f170281b73213c78a73a4c5f23
MD5 SHA1 SHA512

Submit Download

6b6bc8cd-639a-4aed-84a8-bb1eb190f0d0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\6b6bc8cd-639a-4aed-84a8-bb1eb190f0d0
Size 25KB
SHA256 4ec44ca6e51d9397941fe7017cbb876f183afda29535cad453dad0d5bef85f2d
MD5 1227904bd4f29748011f988b4a7b4552
SHA1 45ef549cf32e16d8e0fc3dc766fd6de0d2b5360f
SHA512 d393146a9eb30e96ed8f4766740ab25f52b6085f7e1b45f4f76271540241b6d69d34a7e77ef01821ca216868e37af56593ddef25a8f14846bfb39098be10ef61
SSDEEP 192:jVYYM4XU1LljjAknyDarJ3Gdj5CAdZifXbcKK3ujfEuf18bAAnFsMlQx+lyUWhhw:RYxtU6lGMwaLBnUfg7gs2Yi3ZmbVO0A
MD5 SHA1 SHA512 SSDEEP

Submit Download

9161e448-f207-4813-8a57-84ca73fa462d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\9161e448-f207-4813-8a57-84ca73fa462d
Size 671B
SHA256 b2dbfe80862a03564bed7cc968743170675389d0185823a614bb13d5a0927406
MD5 4d8c9a498f1206d9e7a7d3f50b30d2f7
SHA1 2730aaa45fbba6e389dabb9ca8ccfbb2b8e97ffe
SHA512 f63b7438516bc667bf3092474cd70319b8b28092a40d1ce3b5f754f2c1f2ab4fdbc0e1999d305e5448b1592307766151d3e4487c359901378d44ef63b9b6aba6
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs-1.js
Size 11KB
SHA256 7fe43c599e3e9c22470507e2796f209d8e8531c3968c6fab2c9521dc5ec42d14
MD5 72bd32c514762afdab335fd9133ec93a
SHA1 f66098ee22f13c19a8a4797fdf67d70d3167ef06
SHA512 eccbdc2c372515fd75d76f0b2cd28e81538a630bb20f4e25cbb22ae716fcefdfe9452384ab91dc5529cc2901e8396beded99affbc4ec52af7473c6bd2981b5f4
SSDEEP 192:Y5nRR+fEa3nbsxn/d35QtrUDtrVmtq2V1I0D5laXUtZGBw8HL:/jsxJ8T7tKwa
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs-1.js
Size 16KB
SHA256 505f8f65c1f549355878a95fc8b5b65daf650872e03acf7020b9d5cbe257a4aa
MD5 53f86526221ef014c8c63fb05b598c54
SHA1 2fde583cf1cc591433804519aac0710b7a91d2aa
SHA512 308a459cd531ac44e92eb02cfdb144147e2261dd7aac18eb5ea5368071a074075c2c673b24602d809587f1f38df63cfd5cc4bbadd6e789c55cc9c2edaca7ec18
SSDEEP 192:sanRR+fTa3nbsxn/d35QtrUDtrVmtq2V1I0D5laXY+tZwiBw8H6z552ld:EusxJ8T0txwvtY
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs.js
Size 13KB
SHA256 f795d8ebf91d0587e73e57619de571da678b7e713af60cffc6b7aa5325009a96
MD5 875ba86639f989f03fc582b435ed62d1
SHA1 949f7c5b53269825c5e252d627fd405c011ba109
SHA512 fea2d5fa28410fbe6cf604e8708f8b1264bb5263995b3f6c92cb63a999299cea1e01526a51d54145cacc8a287354af1a4329ffb30f2fe2dad1f0513aa0ebd82b
SSDEEP 192:s5nRR+fEa3nbsxn/d35QtrUDtrVmtq2V1I0D5laXUtZzBw8HT8:zjsxJ8T7tHwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs.js
Size 10KB
SHA256 115ee5d12bce738b79c744173cd355570015ed087a9789208162891b6b266ba8
MD5 de11b9976d482a690d6f8f1b499d35e7
SHA1 539cc677d5379c2ef979a046a6906a151362e416
SHA512 7b5ca0c1d3915f238559f100b2434bf66b67020a9006e36fb1b16dec95242e002a20ccb26d989d5c6b5d7175457d004d5270e6a53411707fed3596f4aad6d19f
SSDEEP 192:Y5nRR+fEFsLiSfRtv99IecdC88fit985x8f0raXMtZGBw8VL:/riSrv99Irl8I9C+qtKw0
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 cee6d8f7ad3f5a982e875f46b513bd74db75c1e86751e7bf4f23f21f9a23f8e0
MD5 726cd30bfd4c3a45b74dcf60f42d6416
SHA1 221975f8ab61475189a165c4928b8bbd611d5fa5
SHA512 e3a2110f097774fbf6b57b76e2df2891aa01ef63c5d302f451131d2ef706b067fd680bba3d9a51a33b94557cb53da302b28515c194c5fd5e64d91639334213e4
MD5 SHA1 SHA512

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\sessionstore-backups\recovery.baklz4
Size 3KB
SHA256 d8b6c3ca2bb2ee3a1c0b7da0eb6f218d1a6bb16c3030b0a897952dae181abe89
MD5 b36d469c7080e6579597b8fd8adb9d16
SHA1 f923ebfc301569ec1394065cb9483fb8b3dbe677
SHA512 aa8b3c8e7a99bd12516059e967def5c703479acdfdf7b76d88262a37b357814e27ce4b123b46a7fdc872b0d9b8d96daabdb419eba01f0848c8b4d96bbf3dc425
MD5 SHA1 SHA512

Submit Download

Holzer.exe

Path C:\Users\Admin\Downloads\Holzer.exe
Size 135KB
SHA256 cede0b15d88c20bc750b516858f8bf31ee472f6cbd01640840890736c4333cce
MD5 c971c68b4e58ccc82802b21ae8488bc7
SHA1 7305f3a0a0a0d489e0bcf664353289f61556de77
SHA512 ff199691c35f2748772410bf454e8b76dd67d892dd76fc87d20b3bbe6c145c6af1685344de636326692df792f55d0fba9a0025a7cf491d0b4e73ff45c3b039d7
SSDEEP 3072:2EYGNIaWY/0kTKxIJXtJ0YCHiQtSetFITTTTTHvvvvvNKB:HN5TKvr9PuKB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Holzer.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Holzer.exe:Zone.Identifier
Size 50B
SHA256 86a3e68762720abe870d1396794850220935115d3ccc8bb134ffa521244e3ef8
MD5 dce5191790621b5e424478ca69c47f55
SHA1 ae356a67d337afa5933e3e679e84854deeace048
SHA512 a669e10b173fce667d5b369d230d5b1e89e366b05ba4e65919a7e67545dd0b1eca8bcb927f67b12fe47cbe22b0c54c54f1e03beed06379240b05b7b990c5a641
MD5 SHA1 SHA512

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 5KB
SHA256 b51a3af1f4b6b37b3f2caab11380671387187157e54c80d5990b18e806a677c3
MD5 3d4e2f511bb1a60edb3802e0a976f804
SHA1 7d271e0a5d8237345612e4dbbf48e113c2fe5eee
SHA512 ee5d2cf3369d5bca083823b5bc6fb1b9a042b285d298d0019808fd4f057e7a3d5de082a63fea0f8adc8e74c407e500bc9470dd699dcf4e9895d29c410e3f0d81
SSDEEP 96:0aKSdTS8l0QhNwkNKDOKDOKD5KDOKfdraA8rDa71Oxy:0aKSFS8lwkg33Q3xaA8rO71Cy
MD5 SHA1 SHA512 SSDEEP

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 13KB
SHA256 00dee8e57ef535822cb0e6f26e90cd625ff788fa8433660ce84d16992dfb159d
MD5 c7554053ebc553f2b79eb4fe44772786
SHA1 c844315961ad937c030e49ceb38ff36ac8455f63
SHA512 ab8a4fb2d5237b5400efb55100438437a939a8a9d729579b129add3eb1b5632b9957a331b7bca1c5eabac3b2dfa79b31a527396283ae4e20b7c8fc8e1975467d
SSDEEP 192:ZSoL7J3BWe+VVidbCS+BcxMFU7m5D6lBUlGE/REaOYEh3QLSwig+bsecqtbBLFfu:w23BWe+bilATwZQaFhX0
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 12KB
SHA256 d445c96bf5c1be65479218250c9dc07cec2c548fec7a505aa6fa105a0137beb9
MD5 08d03e4294be07ea68e2c2f28b9d1ab3
SHA1 1fc001db3052634a1198c993c2e8f0359ccfa101
SHA512 2827ebdbb66238a601c4153c1ab9adb37846594c864390a2130283b19eccd999c43cccc3076007440197fcdda08e81f5f02e872790d6c350bc658a623906ae0c
SSDEEP 192:53gbq3gbHRS3gbY3gbq3gbH0/3gbH7uq5:53Iq3II3IY3Iq3IQ3I5
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 14KB
SHA256 d48b332ef1852f71af824be420bea0e26193d8a033f61bb82d62aa23b9264f74
MD5 10d06f3a7b012d14ca7c371afdbe663c
SHA1 c28bebd616fd89a001761ef038c770983d98f440
SHA512 19185d834f508cc26f2713969f1cab897bce113f041c2bd571d310bdee5fffa9807fbc4c273834c9cd8f23f509a7efdc7921310a1344d98180d3a71ba61b86e9
SSDEEP 192:53gbq3gbHRS3gbY3gbq3gbH0/3gbH7uqe3gbHSVh:53Iq3II3IY3Iq3IQ3Ie3IyP
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 17KB
SHA256 15a76b2ef1b8f46a8dae7708a235f2e424370808fe69ba7c225e9ec0f148a69b
MD5 1d3b3c8bba52670f34af7d31d8123dba
SHA1 e972ad4c494a079a22ef9e6d4db491335a685321
SHA512 c591fdda56df1f7b3204b8ca7f1d4fc1158360507c1b1b9257df0af15805d0a8a28495b6588f30ec2fb779572192405d7bcde6934ab30b2ece138e62cf288520
SSDEEP 192:53gbq3gbHRS3gbY3gbq3gbH0/3gbH7uqe3gbHSVU3gbHg+:53Iq3II3IY3Iq3IQ3Ie3Iyu3Ih
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 19KB
SHA256 778545782dbaa0169e9c4eb235a4091ca2610ad5593b49c831e5fb3c7715237d
MD5 9838ae470f16cf76477234b3596e3136
SHA1 f0e2d48fd8a2eacb0839c34f061e5c611fa4f215
SHA512 1c478ffac18e4cddc45707ff493a7145e4c635ae41da99aab4e8242c5e8b350ca9b3e5eb0bc3452ec3efef23ae7ea6940a8d27b431f2466c99f19048df6a3c77
SSDEEP 192:53gbq3gbHRS3gbY3gbq3gbH0/3gbH7uqe3gbHSVU3gbHgb3gbHR6:53Iq3II3IY3Iq3IQ3Ie3Iyu3IU3IM
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 12KB
SHA256 a9d541857747db3fa4e29da5ada66fa122712ec921b09c3d438310d4edafcc33
MD5 bcd5c1967ff6eaa2b832450e97ee187d
SHA1 bf1598a43c08eae84944a4eca01461d916585178
SHA512 55b4832ab1537b53597dfb7d0ba5cfddecb6c08f21e8d4bd36f1195eebf736a48e704b89f8058de5a2e070680291d598e762aa2b1c1f748604791d704da83491
SSDEEP 96:5MwiGdgbneLHMwiGdgbnEBgCcZbBQBJBH6HMwiGdgbnYMwiGdgbneLHMwiGdgbnt:53gbq3gbExchGHm3gbY3gbq3gbq3gbt
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 14KB
SHA256 2db680527bf1e34273afcfd69c8c724ba3804963d4d1f14ff54beaa9c7ed1550
MD5 4d964f2e0c70b80c1c7d6e1fbcc142fd
SHA1 c17fd43d42ab97cfde53de1a484656cf429b92e5
SHA512 af3549c44790098380774e85a30ce238df3236a580fecfa496d49b21e5a62062ccfe93bbeac6621ea45f1be77fe5c19e4966df81416912d1242e8e9ac4b3f8c5
SSDEEP 192:53gbq3gbExchGHm3gbY3gbq3gbq3gbq3gbD:53Iq3Iwcn3IY3Iq3Iq3Iq3ID
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 16KB
SHA256 9539627cd25de23087bfc2ba07e76838a5fc5f61081ed283cea7f9df1f325aca
MD5 c6e599ece2c3da2e60d2dd72295992dc
SHA1 6791db33239eb1bf0921a82a546b984e9edd3bb7
SHA512 63605d4eeaeba8e281eb32597589c9d525e22c2bbf99304cd1051273f2f4f4c61c1288f1886e7c4a0fa75805e89f0b822bdaeb761deaeb76f526698d4bbdf9b2
SSDEEP 192:53gbq3gbExchGHm3gbY3gbq3gbq3gbq3gbq3gbD:53Iq3Iwcn3IY3Iq3Iq3Iq3Iq3ID
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 17KB
SHA256 96401e6b9f02bb5891cffa6bbee2d78732f3743fb187415102b4391e516cc0c4
MD5 6f492608545e3aac52ef76e81d5dd0d3
SHA1 b59f35e5d96a9a6a6b78337acc1cbce260e60939
SHA512 948dd731a8b950781ec4e24d73f987b0d22847b2d8ca4a72614f5442a64a0812cfcfe07c73769149144d6ca53d7ed5e588274439e1d4490f4cc096a4bb351297
SSDEEP 192:53gbq3gbExchGHm3gbY3gbq3gbq3gbq3gbq3gbq3gbD:53Iq3Iwcn3IY3Iq3Iq3Iq3Iq3Iq3ID
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupact.log

Path C:\Windows\Panther\UnattendGC\setupact.log
Size 46KB
SHA256 5557e196aba7bf493c47ac90b9def00c7c0c1b79e056a1359c3c9a6f37b1aa96
MD5 8a3ad031c995291557dd1ec19f4c58ef
SHA1 95e472181b4ee94052355368bb65a3e720fc21d6
SHA512 1b3cf4b6d2ab669ce8c4542997dd5f665eff48416b536b052d20af7a3d70b16c4ff6f36725062431e08669653173c77fe04b6ed2e5ac6189ac8accab61bb5e54
SSDEEP 768:mBaKNfz5jyPzMPTEPXYj9wAFu5VBSgx+b81SPAgDySPAMBhGW/4y1AB3MU7nBu:1KNfz5jyLMPTEPXYj9wAFu5VBSgx+b88
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupact.log

Path C:\Windows\Panther\UnattendGC\setupact.log
Size 46KB
SHA256 0fecc27d5b2884817cfb6a12d8b394ae437a54e95a3f5886f45f0a16859f6539
MD5 5e81a68e52a85a197c09696f1aa3c177
SHA1 bd2e61a7fcac6b8aa666cf86cd0a4f9bcd3edf65
SHA512 7d88b6f0a5e6e63990cf7057c156e5b9e14fc735204c22c6e8a470053f2d861673506223a2f2541f2a929067ba2cb97cd3da92b77f94b828338877612042c416
SSDEEP 768:mBaKNfz5jyPzMPTEPXYj9wAFu5VBSgx+b81SPAgDySPAMBhGW/4y1AB3MU7nBF:1KNfz5jyLMPTEPXYj9wAFu5VBSgx+b8b
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupact.log

Path C:\Windows\Panther\UnattendGC\setupact.log
Size 47KB
SHA256 37bdffdc9c9a2cf86730e66795a2f4e9903d60f549adf09ccae0a4e927b4d386
MD5 ab6e4712a0ff291915e23640bd5cbe6b
SHA1 df6d1443fa18b85fdd37b281fd809b7ce94cfc97
SHA512 7025eb8259b22612b78d5a18b9c1daa393854f1f888f5f902232e43036b0074295eac157f3cb7e66af99482f0f49b87d1c6f08659314e97c8f7b045fbba1a1cd
SSDEEP 768:mBaKNfz5jyPzMPTEPXYj9wAFu5VBSgx+b81SPAgDySPAMBhGW/4y1AB3MU7nBZ:1KNfz5jyLMPTEPXYj9wAFu5VBSgx+b8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupact.log

Path C:\Windows\Panther\UnattendGC\setupact.log
Size 47KB
SHA256 4f0eb3af36143d9674412a8f87b71959e28bf0e9077467c4e1857676e7d7decc
MD5 60901598d0a3d5e163ab9c096d0c3794
SHA1 7ffce292486096993a528f167c949c74f4602b7a
SHA512 64e320a84d7706d787210ebb0a41b6ecf854c866bd573b8948e4d24b7770a5069ea36ea6411fede60ec7838c2c8650bd1e990bce7b1a4aff51cfc1987b37c4a0
SSDEEP 768:mBaKNfz5jyPzMPTEPXYj9wAFu5VBSgx+b81SPAgDySPAMBhGW/4y1AB3MU7nBZ:1KNfz5jyLMPTEPXYj9wAFu5VBSgx+b8v
MD5 SHA1 SHA512 SSDEEP

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 547B
SHA256 954ccb999511cbb927bbd482cce6c3ff51867c3b522380492ce6c4b8bd3d5dbc
MD5 d44c332a7da66068f6941be84996c2c0
SHA1 eebe55f8355ded1c35f3bff0fa7710c6d073be75
SHA512 65bf3df0464645a0e0f009449f245183e388ed1e58bd2746f27a35f24d13a336a1ab1942c785024ea643ed520553764370c9a24b2c66e792eeeef9335c272b57
MD5 SHA1 SHA512

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 827B
SHA256 b83bb641cab1da368a7e4bdfa686863a02d3001bca26a6d3f6d219914396664d
MD5 dc673355054bd623676bad5bc5c63bb5
SHA1 0c2905cc621b15e6ca19a4d111f8488722c9bef0
SHA512 3fe645bcd88329f90aaf2aee33c170e6eaf874398c4392b7a2036cad07ba5f1c647cf8449e8d64cdfd0a30cdeff2ce3c9998a2a8ca00c981d3f46f8df152f53a
MD5 SHA1 SHA512

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 1KB
SHA256 70cdcf73413663e0129c1943c5f4e0f0b4a5d575d0fff88e9120351326b1e3b0
MD5 8f19be5579a58cb64cdfde341afea614
SHA1 3086f678bec673eec4df01bffd837f143cc23806
SHA512 8e4fc8b75a48cd47583c57c3d72ac5663d3e80b458334ff69e86123566d6abe134534bc294b0dd017b13509aa46091d64395c9bfcb7336a1c38bd0c72d1d2ad3
MD5 SHA1 SHA512

Submit Download

setuperr.log

Path C:\Windows\Panther\UnattendGC\setuperr.log
Size 1KB
SHA256 d751fa458efff1d76404f8a01d34601f8a8afd064bd0d6bfbcbec8fc831c2f19
MD5 6680d421d537c226f704ab93a78c7594
SHA1 c4614c2cb5b24c454b6537122bfe8144ce756e2f
SHA512 537a5c1df833a1c23a4b25726a8c99cbd170259d6d83716cf3c552caab41c6481daff655c4a9803d3fe93fcf92b41c7a6effcfbc4c3a4ce21ca7c0c7d5f9e68c
MD5 SHA1 SHA512

Submit Download

memory/32-4409-0x0000000075B10000-0x0000000075BEF000-memory.dmp

Download

memory/32-4389-0x00000000006D0000-0x00000000006E1000-memory.dmp

Download

memory/5392-4378-0x000000001C080000-0x000000001C0DA000-memory.dmp

Download

memory/5392-4381-0x000000001CE30000-0x000000001CEB6000-memory.dmp

Download

memory/5392-4382-0x000000001D2A0000-0x000000001D674000-memory.dmp

Download

memory/5392-4379-0x000000001C920000-0x000000001CE2E000-memory.dmp

Download

memory/5796-4413-0x00007FFBB5C40000-0x00007FFBB5E49000-memory.dmp

Download

memory/5796-4399-0x00007FF75D6B0000-0x00007FF75DB74000-memory.dmp

Download

memory/5796-4414-0x00007FFBB4020000-0x00007FFBB40DD000-memory.dmp

Download

memory/5796-4416-0x00007FFBB37E0000-0x00007FFBB387D000-memory.dmp

Download

memory/5796-4415-0x00007FFBB3130000-0x00007FFBB34A4000-memory.dmp

Download

memory/6012-4296-0x0000000000850000-0x0000000000860000-memory.dmp

Download

memory/6012-4276-0x0000000000850000-0x0000000000860000-memory.dmp

Download

memory/6012-4301-0x0000000000850000-0x0000000000860000-memory.dmp

Download

memory/6012-4278-0x0000000000850000-0x0000000000860000-memory.dmp

Download

memory/6012-4275-0x0000000000850000-0x0000000000860000-memory.dmp

Download

memory/6552-4355-0x00000202D32C0000-0x00000202D32E4000-memory.dmp

Download

memory/6552-4354-0x00000202D32C0000-0x00000202D32EA000-memory.dmp

Download

memory/6552-4323-0x00000202B8690000-0x00000202B86B2000-memory.dmp

Download

memory/6552-4332-0x00000202D2CA0000-0x00000202D2CC2000-memory.dmp

Download

memory/6552-4352-0x00000202D3020000-0x00000202D302A000-memory.dmp

Download

memory/8092-4072-0x0000000001830000-0x0000000001840000-memory.dmp

Download

memory/8340-4287-0x00000000012A0000-0x00000000012B0000-memory.dmp

Download

memory/8340-4262-0x00000000012A0000-0x00000000012B0000-memory.dmp

Download

memory/8340-4264-0x00000000012A0000-0x00000000012B0000-memory.dmp

Download

memory/8340-4286-0x00000000012A0000-0x00000000012B0000-memory.dmp

Download

memory/8340-4281-0x00000000012A0000-0x00000000012B0000-memory.dmp

Download

memory/8340-4263-0x00000000012A0000-0x00000000012B0000-memory.dmp

Download

memory/9444-4293-0x0000000001240000-0x0000000001250000-memory.dmp

Download

memory/9444-4269-0x0000000001240000-0x0000000001250000-memory.dmp

Download

memory/9444-4289-0x0000000001240000-0x0000000001250000-memory.dmp

Download

memory/9444-4267-0x0000000001240000-0x0000000001250000-memory.dmp

Download

memory/9444-4266-0x0000000001240000-0x0000000001250000-memory.dmp

Download

memory/10320-4185-0x0000000035FB0000-0x0000000035FC0000-memory.dmp

Download

memory/11148-4273-0x00000000012C0000-0x00000000012D0000-memory.dmp

Download

memory/11148-4274-0x00000000012C0000-0x00000000012D0000-memory.dmp

Download

memory/11148-4261-0x00000000012C0000-0x00000000012D0000-memory.dmp

Download

memory/11148-4260-0x00000000012C0000-0x00000000012D0000-memory.dmp

Download

memory/11148-4259-0x00000000012C0000-0x00000000012D0000-memory.dmp

Download

memory/11148-4265-0x00000000012C0000-0x00000000012D0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads