crimsonrat | hxxp://github[.]com

Analysis

max time kernel
237s
max time network
408s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2024 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://github.com

Score

10^/10

crimsonrat darkcomet njrat revengerat guest discovery evasion macro macro_on_action persistence privilege_escalation rat stealer trojan upx

Malware Config

Extracted

Family

crimsonrat

185.136.161.124

Extracted

Family

revengerat

Botnet

Guest

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Signatures

CrimsonRAT main payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023dc0-625.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	5744	10024	rundll32.exe	404
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	12224	3344	runonce.exe	152

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0008000000023dc4-932.dat	revengerat

Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4628	netsh.exe

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
behavioral1/files/0x0008000000023dd4-768.dat	office_macro_on_action

Sets file to hidden 1 TTPs 64 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
8288	attrib.exe
10664	attrib.exe
5820	attrib.exe
12068	attrib.exe
10328	attrib.exe
11836	attrib.exe
7516	attrib.exe
10172	attrib.exe
11596	attrib.exe
3700	attrib.exe
3080	attrib.exe
7364	attrib.exe
10236	attrib.exe
7704	attrib.exe
11780	attrib.exe
4780	attrib.exe
9272	attrib.exe
11280	attrib.exe
5760	attrib.exe
8276	attrib.exe
5932	attrib.exe
9236	attrib.exe
4584	attrib.exe
6468	attrib.exe
11964	attrib.exe
8232	attrib.exe
7928	attrib.exe
11840	attrib.exe
11952	attrib.exe
2380	attrib.exe
8552	attrib.exe
9860	attrib.exe
9060	attrib.exe
10904	attrib.exe
9752	attrib.exe
8940	attrib.exe
3956	attrib.exe
6860	attrib.exe
9924	attrib.exe
5816	attrib.exe
8608	attrib.exe
9124	attrib.exe
8836	attrib.exe
3804	attrib.exe
8688	attrib.exe
8940	attrib.exe
8272	attrib.exe
8508	attrib.exe
6880	attrib.exe
7932	attrib.exe
3244	attrib.exe
4104	attrib.exe
3080	attrib.exe
11708	attrib.exe
9452	attrib.exe
9804	attrib.exe
11984	attrib.exe
5252	attrib.exe
6608	attrib.exe
10588	attrib.exe
10924	attrib.exe
12148	attrib.exe
10108	attrib.exe
5468	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe	NJRat.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe	NJRat.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe\:SmartScreen:$DATA	NJRat.exe

Executes dropped EXE 7 IoCs

pid	Process
1268	CrimsonRAT.exe
2816	dlrarhsiva.exe
2152	CrimsonRAT.exe
5068	dlrarhsiva.exe
3092	NJRat.exe
3896	NJRat.exe
3112	RevengeRAT.exe

Loads dropped DLL 1 IoCs

pid	Process
3344	WINWORD.EXE

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\Downloads\\NJRat.exe\" .."	NJRat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\Downloads\\NJRat.exe\" .."	NJRat.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
108	raw.githubusercontent.com
109	raw.githubusercontent.com
177	0.tcp.ngrok.io
181	0.tcp.ngrok.io
215	0.tcp.ngrok.io
274	0.tcp.ngrok.io
299	0.tcp.ngrok.io

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3112 set thread context of 2148	3112	RevengeRAT.exe	160
PID 2148 set thread context of 4620	2148	RegSvcs.exe	161

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0012000000023e3c-274039.dat	upx
behavioral1/memory/5948-285470-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/5948-303216-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\_CutButterball	WINWORD.EXE
File opened for modification	C:\Windows\BreakTart	WINWORD.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
8272	7352	WerFault.exe	295
4272	5432	WerFault.exe	437
6280	9632	WerFault.exe	463
9224	1484	WerFault.exe	729
7852	12256	WerFault.exe	789
11232	10008	WerFault.exe	1024
3816	5980	WerFault.exe	1144

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NJRat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NJRat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	RegSvcs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Kills process with taskkill 1 IoCs

evasion

pid	Process
6368	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings	msedge.exe

NTFS ADS 5 IoCs

description	ioc	Process
File created	C:\svchost\svchost.exe\:SmartScreen:$DATA	RegSvcs.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 840581.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 739813.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 130100.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 899226.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
10048	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3344	WINWORD.EXE
3344	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
2132	msedge.exe
2132	msedge.exe
3916	identity_helper.exe
3916	identity_helper.exe
5068	msedge.exe
5068	msedge.exe
1832	msedge.exe
1832	msedge.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe
3092	NJRat.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	3092	NJRat.exe
Token: SeDebugPrivilege	3896	NJRat.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe
Token: SeDebugPrivilege	3112	RevengeRAT.exe
Token: SeDebugPrivilege	2148	RegSvcs.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe
Token: 33	3092	NJRat.exe
Token: SeIncBasePriorityPrivilege	3092	NJRat.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
3344	WINWORD.EXE
2132	msedge.exe
2132	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3344	WINWORD.EXE
3344	WINWORD.EXE
3344	WINWORD.EXE
3344	WINWORD.EXE
2132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 4860	2132	msedge.exe	84
PID 2132 wrote to memory of 4860	2132	msedge.exe	84
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 952	2132	msedge.exe	85
PID 2132 wrote to memory of 944	2132	msedge.exe	86
PID 2132 wrote to memory of 944	2132	msedge.exe	86
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87
PID 2132 wrote to memory of 3772	2132	msedge.exe	87

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
9680	attrib.exe
10284	attrib.exe
6716	attrib.exe
368	attrib.exe
4484	attrib.exe
9832	attrib.exe
9924	attrib.exe
10912	attrib.exe
3244	attrib.exe
4104	attrib.exe
9496	attrib.exe
7088	attrib.exe
6944	attrib.exe
9796	attrib.exe
5660	attrib.exe
8552	attrib.exe
5396	attrib.exe
10616	attrib.exe
5608	attrib.exe
7248	attrib.exe
8476	attrib.exe
11128	attrib.exe
7236	attrib.exe
6364	attrib.exe
7864	attrib.exe
9236	attrib.exe
9192	attrib.exe
8616	attrib.exe
5708	attrib.exe
11876	attrib.exe
744	attrib.exe
10980	attrib.exe
11240	attrib.exe
8688	attrib.exe
10776	attrib.exe
10236	attrib.exe
11424	attrib.exe
3804	attrib.exe
6664	attrib.exe
8288	attrib.exe
9836	attrib.exe
7536	attrib.exe
7372	attrib.exe
9368	attrib.exe
10260	attrib.exe
6892	attrib.exe
8836	attrib.exe
6104	attrib.exe
9608	attrib.exe
10752	attrib.exe
3912	attrib.exe
2788	attrib.exe
8460	attrib.exe
5612	attrib.exe
9548	attrib.exe
12132	attrib.exe
5956	attrib.exe
9824	attrib.exe
11784	attrib.exe
5704	attrib.exe
8608	attrib.exe
10060	attrib.exe
9704	attrib.exe
10588	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://github.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87b2a46f8,0x7ff87b2a4708,0x7ff87b2a4718
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1692 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1268
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:2816
- C:\Users\Admin\Downloads\CrimsonRAT.exe
  "C:\Users\Admin\Downloads\CrimsonRAT.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2152
- - C:\ProgramData\Hdlharas\dlrarhsiva.exe
    "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
    3⤵
    - Executes dropped EXE
    PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1928 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- C:\Users\Admin\Downloads\NJRat.exe
  "C:\Users\Admin\Downloads\NJRat.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3092
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\Downloads\NJRat.exe" "NJRat.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4628
- C:\Users\Admin\Downloads\NJRat.exe
  "C:\Users\Admin\Downloads\NJRat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6624 /prefetch:2
  2⤵
  PID:4304
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\NetWire.doc" /o ""
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:3344
- - C:\Windows\SYSTEM32\runonce.exe
    runonce.exe
    3⤵
    - Process spawned unexpected child process
    PID:12224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:4532
- C:\Users\Admin\Downloads\RevengeRAT.exe
  "C:\Users\Admin\Downloads\RevengeRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:3112
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - NTFS ADS
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4620
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\u4phbzud.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:8476
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5139.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc5145E9382F3149FD8B6E933BF98FB9BA.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0rnevxn9.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4552
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES533D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4C591B70995547A59E65919AAFAF55AE.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7152
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kxjgvrju.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:8436
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES55BE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6F9F510A4B7F436F8DC952E3AEFCDF1.TMP"
        5⤵
        
        PID:4920
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\88zqefoa.cmdline"
      4⤵
      PID:7036
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57C1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE0C27CD85C9A40A7B774989A9452FD60.TMP"
        5⤵
        
        PID:8288
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\qr4mosrl.cmdline"
      4⤵
      PID:2432
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES59E4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2DEC98747749475A80F599EA7A265F94.TMP"
        5⤵
        
        PID:6896
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ssfd4txx.cmdline"
      4⤵
      PID:8980
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5BA9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4F2EE477F76F46E8BA2624CEC4C4E478.TMP"
        5⤵
        
        PID:5944
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rnu9qjzj.cmdline"
      4⤵
      PID:7808
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E49.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3140B64C612D4E339F93265C50ED9D38.TMP"
        5⤵
        
        PID:5212
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nexnhj26.cmdline"
      4⤵
      PID:5688
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6147.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD9A87E1A332841C096E6C96A4C2E5E79.TMP"
        5⤵
        
        PID:7932
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\83ntpjnh.cmdline"
      4⤵
      PID:8476
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES632B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC31BD7CE8B174F5C905579A1304EC4F.TMP"
        5⤵
        
        PID:8292
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\buzspalg.cmdline"
      4⤵
      PID:2948
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES658C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4A2A2358766948EDACD9DAFA8F37ED73.TMP"
        5⤵
        
        PID:6992
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\clj-7jni.cmdline"
      4⤵
      PID:880
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES67CF.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB9809439B254A88BD467A4654C14078.TMP"
        5⤵
        
        PID:8140
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\na5gowyj.cmdline"
      4⤵
      PID:6648
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C14.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9A6FD94EF0FA42B4A431880BF67816A.TMP"
        5⤵
        
        PID:4568
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yek-bzxk.cmdline"
      4⤵
      PID:6004
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F70.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc19E7DF72E8F14026AEDCFCA6197E380.TMP"
        5⤵
        
        PID:7748
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oxfcfcjr.cmdline"
      4⤵
      PID:9052
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES71F0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE6E19C1BDC3644A4BECBC8EF37AB5142.TMP"
        5⤵
        
        PID:8880
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mphwwlvg.cmdline"
      4⤵
      PID:8204
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES74EE.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8E931A7DEA3148088F236EDA3EC1371D.TMP"
        5⤵
        
        PID:8504
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
      4⤵
      PID:5916
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:7740
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        6⤵
        
        PID:2432
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dgzy53tv.cmdline"
        6⤵
        
        PID:8220
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE56.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE038BB5D1A2344428C1062D9390B0A4.TMP"
        7⤵
        
        PID:7292
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ev0kenhr.cmdline"
        6⤵
        
        PID:9800
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE173.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc20CD6F68BC1C44D5A58734FCDBF3102A.TMP"
        7⤵
        
        PID:8292
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jwoq2yzg.cmdline"
        6⤵
        
        PID:9632
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE3B5.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBD797ACCD80F4241AA391BF3961F7B7D.TMP"
        7⤵
        
        PID:9492
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rjypxvmb.cmdline"
        6⤵
        
        PID:7172
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE59A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB5DF34AB41F34C2994AE8DCD6F5B4531.TMP"
        7⤵
        
        PID:10184
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\pqovnyzm.cmdline"
        6⤵
        
        PID:6728
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE7FB.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc637CC5DA180C4DB684279B0613B29DA.TMP"
        7⤵
        
        PID:8432
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mhbh4evf.cmdline"
        6⤵
        
        PID:2688
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC31.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBD97031B78AE4787A512A6707784116E.TMP"
        7⤵
        
        PID:5468
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10048
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\wgfdlcqc.cmdline"
        6⤵
        
        PID:7172
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES595.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA4A724AAE6A446D490AD1253DE62108C.TMP"
        7⤵
        
        PID:6688
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gasmce0x.cmdline"
        6⤵
        
        PID:9068
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7D7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc6EF101AD4FB242D9B4105C7EF41D6982.TMP"
        7⤵
        
        PID:5948
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nse2qmsf.cmdline"
        6⤵
        
        PID:8680
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA77.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc2E60656EEF23409085DFDF66127FDDD.TMP"
        7⤵
        
        PID:9272
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rdpjruxq.cmdline"
        6⤵
        
        PID:8164
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDC3.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9E8F356FAFFD4E3B8267819476B6519.TMP"
        7⤵
        
        PID:9276
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\k2pydhmr.cmdline"
        6⤵
        
        PID:9096
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1034.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA8E9013E800A44C2A96A1AADD2C5F792.TMP"
        7⤵
        
        PID:7008
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\rxomvxom.cmdline"
        6⤵
        
        PID:8872
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES141C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9B1F4A03CAA04F50A33C159CDE9ECC1.TMP"
        7⤵
        
        PID:6280
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\0legcxy0.cmdline"
        6⤵
        
        PID:6800
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES169D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8062479E44B445ADABE9BB470A8537B.TMP"
        7⤵
        
        PID:10152
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\jehjvrbj.cmdline"
        6⤵
        
        PID:7316
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1A94.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc358A55D73A9143C689A7A4304F892057.TMP"
        7⤵
        
        PID:7328
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-347qcvl.cmdline"
        6⤵
        
        PID:8204
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1D92.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9A9D107AE99B426AAE44C99A72A4FCC0.TMP"
        7⤵
        
        PID:8644
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\obyvwg1z.cmdline"
        6⤵
        
        PID:10352
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES23CC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc80E3CA358CD342BA932AB1525F32379A.TMP"
        7⤵
        
        PID:11148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:8260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3272 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1124 /prefetch:8
  2⤵
  PID:1320
- C:\Users\Admin\Downloads\Blackkomet.exe
  "C:\Users\Admin\Downloads\Blackkomet.exe"
  2⤵
  PID:220
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:6228
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\Downloads\Blackkomet.exe" +s +h
    3⤵
    PID:8244
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\Downloads" +s +h
    3⤵
    PID:6388
- - C:\Windows\SysWOW64\Windupdt\winupdate.exe
    "C:\Windows\system32\Windupdt\winupdate.exe"
    3⤵
    PID:8048
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      PID:7708
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
      4⤵
      Sets file to hidden
      PID:7928
  - - C:\Windows\SysWOW64\attrib.exe
      attrib "C:\Windows\SysWOW64\Windupdt" +s +h
      4⤵
      PID:8584
  - - C:\Windows\SysWOW64\Windupdt\winupdate.exe
      "C:\Windows\system32\Windupdt\winupdate.exe"
      4⤵
      PID:6328
    - - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        5⤵
        
        PID:7096
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        5⤵
        
        PID:3444
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        5⤵
        Views/modifies file attributes
        
        PID:9192
    - - C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        5⤵
        
        PID:6972
      - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        6⤵
        
        PID:5536
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        6⤵
        
        PID:7976
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4552
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        6⤵
        
        PID:7468
      - C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        6⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        7⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        7⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        7⤵
        Sets file to hidden
        
        PID:7932
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        7⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        8⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        8⤵
        Views/modifies file attributes
        
        PID:7536
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        8⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        8⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        9⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        9⤵
        
        PID:1436
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        9⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        9⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        10⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        10⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        10⤵
        Sets file to hidden
        
        PID:9860
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        10⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        11⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        11⤵
        Views/modifies file attributes
        
        PID:5956
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        11⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        11⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        12⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        12⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        12⤵
        Sets file to hidden
        
        PID:10172
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        12⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        13⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        13⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        13⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        13⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        14⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        14⤵
        Sets file to hidden
        
        PID:10108
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        14⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        14⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        15⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        15⤵
        Sets file to hidden
        
        PID:5468
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        15⤵
        Sets file to hidden
        
        PID:8940
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        15⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        16⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        16⤵
        Views/modifies file attributes
        
        PID:6944
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        16⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        16⤵
        
        PID:232
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        17⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        17⤵
        Views/modifies file attributes
        
        PID:5704
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        17⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        17⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        18⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        18⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        18⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        18⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        19⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        19⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        19⤵
        Views/modifies file attributes
        
        PID:9368
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        19⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        20⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        20⤵
        Sets file to hidden
        
        PID:3080
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        20⤵
        Views/modifies file attributes
        
        PID:6364
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        20⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        21⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        21⤵
        Views/modifies file attributes
        
        PID:368
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        21⤵
        Views/modifies file attributes
        
        PID:5612
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        21⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        22⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        22⤵
        Views/modifies file attributes
        
        PID:8616
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        22⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        22⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        23⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        23⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:8608
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        23⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        23⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        24⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        24⤵
        Views/modifies file attributes
        
        PID:6664
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        24⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        24⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        25⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        25⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        25⤵
        Views/modifies file attributes
        
        PID:4484
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        25⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        26⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        26⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        26⤵
        Views/modifies file attributes
        
        PID:9824
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        26⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        27⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        27⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        27⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        27⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        28⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        28⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:8288
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        28⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        28⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        29⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        29⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        29⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        29⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        30⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        30⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:8688
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        30⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        30⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        31⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        31⤵
        Sets file to hidden
        
        PID:9272
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        31⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        31⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        32⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        32⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        32⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        32⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        33⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        33⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        33⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        33⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        34⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9632 -s 376
        35⤵
        Program crash
        
        PID:6280
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        34⤵
        Views/modifies file attributes
        
        PID:10060
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        34⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        34⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        35⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        35⤵
        Views/modifies file attributes
        
        PID:5608
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        35⤵
        Sets file to hidden
        
        PID:8940
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        35⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        36⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        36⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        36⤵
        Views/modifies file attributes
        
        PID:9680
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        36⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        37⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        37⤵
        Views/modifies file attributes
        
        PID:5708
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        37⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        37⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        38⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        38⤵
        Sets file to hidden
        
        PID:3956
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        38⤵
        Views/modifies file attributes
        
        PID:7864
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        38⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        39⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        39⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        39⤵
        Sets file to hidden
        
        PID:5820
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        39⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        40⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        40⤵
        Views/modifies file attributes
        
        PID:9796
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        40⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        40⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        41⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        41⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        41⤵
        Views/modifies file attributes
        
        PID:9832
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        41⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        42⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        42⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        42⤵
        Sets file to hidden
        
        PID:7364
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        42⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        43⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        43⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        43⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        43⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        44⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        44⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        44⤵
        Views/modifies file attributes
        
        PID:7248
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        44⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        45⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        45⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3244
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        45⤵
        Views/modifies file attributes
        
        PID:5660
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        45⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        46⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        46⤵
        Sets file to hidden
        
        PID:6468
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        46⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        46⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        47⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        47⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        47⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        47⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        48⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        48⤵
        Views/modifies file attributes
        
        PID:9836
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        48⤵
        Sets file to hidden
        
        PID:9060
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        48⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        49⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        49⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        49⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        49⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        50⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        50⤵
        Sets file to hidden
        
        PID:6860
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        50⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        50⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        51⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        51⤵
        Sets file to hidden
        
        PID:5252
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        51⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        51⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        52⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        52⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4104
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        52⤵
        Views/modifies file attributes
        
        PID:6104
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        52⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        53⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        53⤵
        
        PID:444
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        53⤵
        Sets file to hidden
        
        PID:12068
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        53⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        54⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        54⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        54⤵
        Sets file to hidden
        
        PID:11964
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        54⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        55⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        55⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        55⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        55⤵
        
        PID:396
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        56⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        56⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        56⤵
        
        PID:880
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        56⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        57⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        57⤵
        Views/modifies file attributes
        
        PID:11784
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        57⤵
        Views/modifies file attributes
        
        PID:9608
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        57⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        58⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        58⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        58⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        58⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        59⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        59⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        59⤵
        Sets file to hidden
        
        PID:11280
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        59⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        60⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        60⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        60⤵
        Sets file to hidden
        
        PID:10328
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        60⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        61⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        61⤵
        Views/modifies file attributes
        
        PID:10284
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        61⤵
        Sets file to hidden
        
        PID:9124
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        61⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        62⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        62⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        62⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        62⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        63⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        63⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:9924
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        63⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        63⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        64⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        64⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        64⤵
        Views/modifies file attributes
        
        PID:10260
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        64⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        65⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        65⤵
        Views/modifies file attributes
        
        PID:10776
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        65⤵
        Sets file to hidden
        
        PID:10904
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        65⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        66⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        66⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        66⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        66⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        67⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        67⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        67⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        67⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        68⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        68⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        68⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        68⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        69⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        69⤵
        Views/modifies file attributes
        
        PID:10752
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        69⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        69⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        70⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        70⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        70⤵
        Views/modifies file attributes
        
        PID:8476
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        70⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        71⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        71⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        71⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        71⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        72⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        72⤵
        Sets file to hidden
        
        PID:11840
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        72⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        72⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        73⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        73⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        73⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        73⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        74⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        74⤵
        Views/modifies file attributes
        
        PID:3912
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        74⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        74⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        75⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        75⤵
        Views/modifies file attributes
        
        PID:9548
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        75⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        75⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        76⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        76⤵
        Views/modifies file attributes
        
        PID:2788
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        76⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        76⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        77⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        77⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        77⤵
        Views/modifies file attributes
        
        PID:8460
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        77⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        78⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        78⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        78⤵
        Views/modifies file attributes
        
        PID:7372
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        78⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        79⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        79⤵
        Sets file to hidden
        
        PID:11708
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        79⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        79⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        80⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        80⤵
        Sets file to hidden
        
        PID:5760
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        80⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        80⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        81⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        81⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        81⤵
        Sets file to hidden
        
        PID:8272
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        81⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        82⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        82⤵
        Views/modifies file attributes
        
        PID:11876
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        82⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        82⤵
        
        PID:396
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        83⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        83⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        83⤵
        Sets file to hidden
        
        PID:11952
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        83⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        84⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        84⤵
        Sets file to hidden
        
        PID:8232
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        84⤵
        Sets file to hidden
        
        PID:11836
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        84⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        85⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        85⤵
        Sets file to hidden
        
        PID:12148
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        85⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        85⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        86⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        86⤵
        Sets file to hidden
        
        PID:11596
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        86⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        86⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        87⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        87⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        87⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        87⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        88⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        88⤵
        Views/modifies file attributes
        
        PID:6892
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        88⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        88⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        89⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        89⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:10236
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        89⤵
        Sets file to hidden
        
        PID:9452
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        89⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        90⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        90⤵
        Sets file to hidden
        
        PID:8276
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        90⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        90⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        91⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        91⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        91⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:9236
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        91⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        92⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        92⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        92⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        92⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        93⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        93⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        93⤵
        Views/modifies file attributes
        
        PID:9496
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        93⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        94⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        94⤵
        Sets file to hidden
        
        PID:7516
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        94⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        94⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        95⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        95⤵
        Sets file to hidden
        
        PID:6608
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        95⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        95⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        96⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        96⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        96⤵
        Sets file to hidden
        
        PID:10664
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        96⤵
        
        PID:11820
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        97⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        97⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        97⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        97⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        98⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        98⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        98⤵
        Sets file to hidden
        
        PID:9804
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        98⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        99⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        99⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        99⤵
        Sets file to hidden
        
        PID:3080
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        99⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        100⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        100⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        100⤵
        
        PID:5748
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        101⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        100⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        101⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        101⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        101⤵
        Views/modifies file attributes
        
        PID:10980
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        101⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        102⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        102⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        102⤵
        Sets file to hidden
        
        PID:7704
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        102⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        103⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        103⤵
        Views/modifies file attributes
        
        PID:11424
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        103⤵
        Sets file to hidden
        
        PID:11984
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        103⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        104⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        104⤵
        Views/modifies file attributes
        
        PID:9704
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        104⤵
        Sets file to hidden
        
        PID:2380
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        104⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        105⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        105⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        105⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        105⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        106⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        106⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        106⤵
        Views/modifies file attributes
        
        PID:744
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        106⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        107⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        107⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        107⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        107⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        108⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        108⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        108⤵
        Views/modifies file attributes
        
        PID:6716
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        108⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        109⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        109⤵
        Views/modifies file attributes
        
        PID:10912
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        109⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        109⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        110⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        110⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        110⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        110⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        111⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        111⤵
        Sets file to hidden
        
        PID:8508
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        111⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        111⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        112⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        112⤵
        Sets file to hidden
        
        PID:11780
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        112⤵
        Sets file to hidden
        
        PID:9752
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        112⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        113⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        113⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        113⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        113⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        114⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        114⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        114⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        114⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        115⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        115⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        115⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:8552
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        115⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        116⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        116⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        116⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        116⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        117⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        117⤵
        Sets file to hidden
        
        PID:5932
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        117⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        117⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        118⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        118⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:10588
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        118⤵
        Sets file to hidden
        
        PID:5816
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        118⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        119⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        119⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        119⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        119⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        120⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        120⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        120⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        120⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        121⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        121⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        121⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        121⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        122⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        122⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        122⤵
        Views/modifies file attributes
        
        PID:8836
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        122⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        123⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        123⤵
        Views/modifies file attributes
        
        PID:12132
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        123⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        123⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        124⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        124⤵
        Sets file to hidden
        
        PID:6880
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        124⤵
        Sets file to hidden
        
        PID:3700
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        124⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        125⤵
        
        PID:716
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        125⤵
        Views/modifies file attributes
        
        PID:5396
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        125⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        125⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        126⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        126⤵
        Sets file to hidden
        
        PID:8836
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        126⤵
        Views/modifies file attributes
        
        PID:11240
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        126⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        127⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        127⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        127⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        127⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        128⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        128⤵
        Sets file to hidden
        
        PID:4780
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        128⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        128⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        129⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        129⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        129⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        129⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        130⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        130⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        130⤵
        Views/modifies file attributes
        
        PID:10616
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        130⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        131⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        131⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        131⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:3804
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        131⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        132⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        132⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        132⤵
        Views/modifies file attributes
        
        PID:11128
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        132⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        133⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        133⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        133⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        133⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        134⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        134⤵
        Sets file to hidden
        
        PID:4584
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        134⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        134⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        135⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        135⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        135⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        135⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        136⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        136⤵
        Sets file to hidden
        
        PID:10924
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        136⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Windupdt\winupdate.exe
        
        "C:\Windows\system32\Windupdt\winupdate.exe"
        136⤵
        
        PID:264
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        137⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h
        137⤵
        Views/modifies file attributes
        
        PID:7236
        
        C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Windows\SysWOW64\Windupdt" +s +h
        137⤵
        Views/modifies file attributes
        
        PID:7088
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        136⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        135⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        134⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        133⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        132⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        131⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        130⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        129⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        128⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        127⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        126⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        125⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        124⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        123⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 80
        124⤵
        Program crash
        
        PID:3816
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        122⤵
        
        PID:464
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        121⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        120⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        119⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        118⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        117⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        116⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        115⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        114⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        113⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        112⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        111⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        110⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        109⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        108⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        107⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10008 -s 416
        108⤵
        Program crash
        
        PID:11232
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        106⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        105⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        104⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        103⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        102⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        101⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        100⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        99⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        98⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        97⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        96⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        95⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        94⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        93⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        92⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        91⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        90⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        89⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        88⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        87⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        86⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        85⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        84⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        83⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        82⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        81⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        80⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        79⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        78⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        77⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        76⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        75⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        74⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12256 -s 76
        75⤵
        Program crash
        
        PID:7852
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        73⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        72⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        71⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        70⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        69⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        68⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        67⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        66⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 88
        67⤵
        Program crash
        
        PID:9224
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        65⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        64⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        63⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        62⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        61⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        60⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        59⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        58⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        57⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        56⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        55⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        54⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        53⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        52⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        51⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        50⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        49⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        48⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        47⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        46⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        45⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        44⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        43⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        42⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        41⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        40⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        39⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        38⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        37⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        36⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        35⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        34⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        33⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        32⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        31⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        30⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5432 -s 416
        31⤵
        Program crash
        
        PID:4272
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        29⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        28⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        27⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        26⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        25⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        24⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        23⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        22⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        21⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        20⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        19⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        18⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        17⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        16⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        15⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        14⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        13⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7352 -s 72
        14⤵
        Program crash
        
        PID:8272
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        12⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        11⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        10⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        9⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        8⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        7⤵
        
        PID:7504
      - C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        6⤵
        
        PID:1312
    - - C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\SysWOW64\notepad.exe
        5⤵
        
        PID:8796
  - - C:\Windows\SysWOW64\notepad.exe
      C:\Windows\SysWOW64\notepad.exe
      4⤵
      PID:6340
- - C:\Windows\SysWOW64\notepad.exe
    C:\Windows\SysWOW64\notepad.exe
    3⤵
    PID:7852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:8836
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\CobaltStrike.doc" /o ""
  2⤵
  PID:10024
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe
    3⤵
    - Process spawned unexpected child process
    PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3952 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1912 /prefetch:1
  2⤵
  PID:12096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7412 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,3266644258873431819,7500193851411910158,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7556 /prefetch:8
  2⤵
  PID:7620
- C:\Users\Admin\Downloads\Birele.exe
  "C:\Users\Admin\Downloads\Birele.exe"
  2⤵
  PID:5948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM explorer.exe
    3⤵
    - Kills process with taskkill
    PID:6368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 7352 -ip 7352
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5432 -ip 5432
1⤵
PID:9312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9632 -ip 9632
1⤵
PID:3672

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
1⤵
PID:12236
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  PID:5464
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
    3⤵
    PID:1756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1484 -ip 1484
1⤵
PID:6688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 12256 -ip 12256
1⤵
PID:6552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 10008 -ip 10008
1⤵
PID:12124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5980 -ip 5980
1⤵
PID:8156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\ProgramData\svchost\vcredist2010_x64.log-MSI_vc_red.msi.ico

Filesize
4KB

MD5
fde1b01ca49aa70922404cdfcf32a643

SHA1
b0a2002c39a37a0ccaf219d42f1075471fd8b481

SHA256
741fe085e34db44b7c8ae83288697fab1359b028411c45dab2a3ca8b9ea548a5

SHA512
b6b4af427069602e929c1a6ce9d88c4634f0927b7292efb4070d15fb40ce39fc5ce868452dcd5642b2864730502de7a4c33679c936beb1a86c26a753d3f4dc25

Download Submit
C:\ProgramData\svchost\vcredist2010_x64.log.ico

Filesize
4KB

MD5
bb4ff6746434c51de221387a31a00910

SHA1
43e764b72dc8de4f65d8cf15164fc7868aa76998

SHA256
546c4eeccca3320558d30eac5dc3d4726846bdc54af33aa63ac8f3e6fc128506

SHA512
1e4c405eca8d1b02147271095545434697d3d672310b4ea2ecca8715eaa9689be3f25c3d4898e7a4b42c413f258eda729a70f5ad8bc314a742082b5a6a8e9ff1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\CrimsonRAT.exe.log

Filesize
1KB

MD5
2d2a235f1b0f4b608c5910673735494b

SHA1
23a63f6529bfdf917886ab8347092238db0423a0

SHA256
c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884

SHA512
10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
3KB

MD5
e2ba60847133288701c13bceeb6ed9cb

SHA1
dd54fdcb77846514c51b656d8a5d117abc5a5c09

SHA256
0e5e675b37d41b93b2f10d10b4e1b12d2e0459a54ecd6b7362985ad0a3acbb2d

SHA512
faff684a3d49ffa38bcb7ae2512b66feea8268e30bf00539b79582122df053a52453edeeae6b96135f66c00e87006fe9617c650cdc1776cb83cb76b8cffa013a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
9e95cd5afb1bb33b182fc383a7bc4e7a

SHA1
7c68bbc1b5f9f307c2747b2420d0b2cbf8e8c8df

SHA256
cb514d44a71ead6a5fada999042e2598dd9a4efc013ce5564d3f71872d633b74

SHA512
1a42d46df54da34b3757361818d58b137fa9d7bbe1e115210ae97751c66542bbe4af093950a3834e0daed41b372726191f6b1cc82258df66a1a3966bc579fbad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
4550fc9a6e43e8aff45b1b6c391885a7

SHA1
a6bf4eaf7658aba8933b1dcb3d1f1117dfc05206

SHA256
05bc55971f99f02840e1e429d2e7fbaf12656170e03dc9d428f2b88c4a343a59

SHA512
b47e636f2913f32c7bc43698ba4448ff913e8ce9f3c208166236b11086b948b31148dcb8e401c2549d5feb3722087de0733fb8331923d3b354a4ee5f7fba4a84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ad3f179fac35ec7c8aaf1bf0e355fac3

SHA1
bd018fd6624fa1012c169c382e1d13ff9a804094

SHA256
6efa4f8ad7121bc1cdd32c54d5c9466cb314f6c7865a0b1ad62615e4773270c7

SHA512
cd901a09780baddb32543b10cbf002032e31531dc28e4e5a26100e6ed7b57bb7d02a9ff73866bb6ff439458c8dcf7daa8a5c87b776fe7eae66474cdecc5908fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3d84f6cbcda5c9102a1fba98fc0fed17

SHA1
19b5e40dd79b609f264c3d1613f963fd43132553

SHA256
f878bd3a1e570b6579534d9e9ccad4ccecad7b9340b811d4c2a09baf87551fe2

SHA512
e45601cdc3954f1abb0d487b8b6b6a5752bb196336db49cc6d54e8a77a38a473026328139a75e36489e545c056a30e45d9aea2af8a62d44880ce5e715467dad0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0373f6899211979210667ef1b50dccf4

SHA1
d853ad3bc55382715bd6e6128732a1f38103e57a

SHA256
c11bf00db692d33ea61f47925361cc9ece93ad0a9381398cd59c9c6a075d43d9

SHA512
efabb2e9da27ebe79cbb1f65be77000185c930a7969f3dec666d76a55bfde7b6f2764ecabb9d1e9b0dee597be3e11f1a6c307327d5fd2053bf643bd70389b728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bf73e46b71764bd7b320f6146b826a49

SHA1
5cdb422dde4cf1d953602949819233a61c7caa01

SHA256
229fdb940af06f4f826e6d7c8edbfb632a6a6f8c891c89778b43699e67701144

SHA512
668c56d64f5c5113f6eb1da87c2b3b2f6687faa465792d2854c0020d4a9ffd95e814d5fd7fe2d30479d5e2857bae95a808717759346e971d9d4dde2407eb8db8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6c053b4ab29dbfb5f14a4074d0bef546

SHA1
dc8a40d77aa09457a4fa118b46156ea8ef25de17

SHA256
632e9ba543f8ceb7c476beb59a1a81c1e93ba5cd33b0f9367853cb158c0061d3

SHA512
2c2d7d86ef9a1b680afebd16579143f8fc9cfadfe126ffcf64cc7affe18c6bca05395e212b74cf17d8240007bcab11393eec570aed9928683d80d8e4afe02019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1a29fa616bf62267c6e388eaa7ae9bac

SHA1
62bc31bd8c5174010121688ac4f61f26196c0be9

SHA256
a2c9f38d2f4237bb669a8aceb1f326e7b34b0d35eff8596659ed85f6a31328ab

SHA512
9efc8f62210d152241a4e89b84f9cb3564032fc9f875b4e7d78182a6dd1781f640ca52524b33bb3e7a6f9425f63f4ca8068d0a4a07d3900e9529e8eba1f8521c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2e0f61f5db2559e1996440d216f2c3e5

SHA1
ad5203321902ac6af315c6fe2f9632766d53d84c

SHA256
6f407d039b5cd08c09eb60b3f64c92cf024b6b2228e10f99a6ad32a108962cc6

SHA512
54fb251c79c18b949c9af0a60ddc5b41e0e1f54a017f4b73c33b37712e46d967028f5c7b3fbcc41d7f0656fd1b981ef4104e6557e7081bc8cd905676069baa7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
12158f4f32ffddf8a71c8f9c4602be84

SHA1
dbf14d2a34e1dd263e6d899e35a086a639c0b4bb

SHA256
c82f21d22ac73f234ad50bfca6250514bdd3309c7004546ea29d4f836fd3f0b9

SHA512
167016ea4de20efb1b4d42fb0e15bb72af568736ec4b77b71b2a50c96cbdc6ccbc87675e7a65a9b28b7ae2cae9fa89217cdf05c14e0dc3f7000f6b945812e691

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f94e2717b840500e24cfff5550700ce0

SHA1
ada3238b66d721f62a03e0456b4340cdf0feb277

SHA256
d91a70f750cc26ad133db92f955278b0b2f4a98d3d138ac314fe26c35ff87520

SHA512
0b81f01bad2b171a0521d0602ed31692836d914c4356acb8f4641a3d8fe4a315c104149df5a8818ea5998c7bdf1521022747da89454ce2773398b31c1c9cf175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d79c8f11e0ada192e678e39f2cd754bf

SHA1
18e9070ff18faf4cb1ed599ee1a4aad39ea61140

SHA256
65ed0bc244ce028af856fa5374f16555f77ac9859f7a2327e520a8f7c9cf89bf

SHA512
6fb07451df285b55042ea7afe00d86ea714220c2053801a7399aad9bc839d0e7379bdf4c326b1eb182024cb275240939af3cf667a4099c9def79b1e0d97f0963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
72491d013993bd9bcc9d995d42921ac8

SHA1
38954e952299b3d0f01d2e95dee07a4c2bb33918

SHA256
49f287cd4dcb84978b417234ae63468d851bc334562a20f63135b9e8718fe7db

SHA512
8599de20bbc1a69270cf0125a0238f463e29b7891c761421aa595a9929545e1d31f9342048790a9ee81986e3b5f214257d5de1456d2d6a5f075796d6890f3212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
65f4d42649cbfc7ed4f50b1790ce9cfe

SHA1
29c85f3a965b9b4aaf6534b870a67c6afd3dbf11

SHA256
d6a23fa2a962cc37aa4b815540fe9fa7fd3fa756faa1f895a3c54dac0bb131c2

SHA512
ae4da04ccc6f77d18dff309937bcddfa6097d720ec33e747b4150336f85af5d987a17af0a897841b21d054deb114389e4396905f456b242f2365ac15d5b61d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2f45cf26956ab0c0dc36f09eb865d481

SHA1
730cd3a77943dfc8bc1ab8a5202abc0a22300196

SHA256
c4b38f347acd465159bf0926ecccfca480676e23d46ff509a41ea515a6dfedfe

SHA512
3204e51ee230eba4737574fea24f8aa928c44acf8f5b7a98fce8502a52149bf5fdc613c5eb7d0b6bfebce0d9df9adce7b0cd7d9a9f52a6e32f5d95c242813cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fcdf3c3abb8a86e78ca1907df0ff8074

SHA1
52a8254c0c5c63255b7226bf29bd60ee2ef8a8d9

SHA256
8d7cedf07c381cb2bbbcbf3a0d87d0b76a58e34dcfcf614ac91f4dd5fef89d30

SHA512
15619afb203b4b5e04d26efb2ef32aedc2b014cd2b24a6d86be3dab7a9b9ed8f350b2ee901c1131d03f1f3732dd71c998fef6758bbc2f0d4942df28246bd8a2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4101f94387b6ce9b5874a67dbc291156

SHA1
99255d99cc45f823daf55256605b229dbf909f91

SHA256
f1d7492607a68dc90f2aaad8e84381f4a70484af5ebb3a089efb3e840bfa8e09

SHA512
b6b3768ce41054e3845de432226b1e157d63756042e0241f9d3cb1e4af9bed3eb2d9ad94143feb2bd7c98ef0cab065ef21cc32891713f99ee618ee04c653dc65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
21c3498ab3d999540a288ea084ce4f68

SHA1
ed32baa19058a295fd289a6e9f4bd78b9eeac258

SHA256
1453aee8dd0ef93c8f55044be70477ff118ecf69526255b3ddf030ddf34666ff

SHA512
7f88486947741d6e275ea54be6d519784abe948ceb9b45d703a2d30412df9d4dcef87e63da99e0261e0d69967b83a5d8235515f4dc234c6072be985fda9fce5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
50dc559a686ff458dd5728082c4b21f8

SHA1
2d3671a8d108797f3ac45206832ead806ea6dd07

SHA256
017b5b7f04b5d631601d4861a9409089f357f3eefef3ff61f539fba979e9d40a

SHA512
e96881ac00a3f940b6bca8e78218e460a0713dabb9e3667cbcd79fbb19e952d91a01fe8e315f6ffe2e61a522653c8e31abe790b26aa1ff71137ac8a59e087e77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
68a4b375226c7af3962c25694555d964

SHA1
d8fb961da7c32c5f552326c4bd16ff0c803f804a

SHA256
ad88b30b74557b5ec7a4f5bfba6e2b41aa6fe4c3fd92bd86d1fb67276cf55c99

SHA512
00a17d7a81a22fb4508519fdb1eb54285205f80ffd26c64d41fc787c11c20b9141dad54476a7f9a22f94b279b2b56ed52fe4b0e0dcd099ae499e1463611197e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
360cfa412ed677c5ddf4ce38760a65e6

SHA1
322771b1be80518b5dca2dbc350c92116f2dc96f

SHA256
84edf6cd986afcd369bb574d4a2aabcceaae9bce1b58a6f34aa654b6966ef59d

SHA512
60d2f3096e73cf5a2b8ec05167ef02b8392aca7bcca48af40f4d21a51c0ffc334f5ef2d78f8dd71bd79821a2733b90cb25d6fadba32316975f7ff5ac6ba9ac5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0dbd64904205d75abd97095fd2917ec3

SHA1
0b03f29e89a8e0835a8b0db6d89d1b017aae0acd

SHA256
cbd0511b7c71aa7bc8bfa59f4550b599ce0eb302dee9c52079c5a2663a1fec2c

SHA512
f9aed7d654e5dc8df6b91371dec62624d2032ef81ff1414b2bd0f3b80f9ef62e2a22970f07c31a5e35fb902484a60b6e61eadb0bdc09a6fd37c6d60069516668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d71c81fec42639288bf93a8338fcb290

SHA1
474ae156462088306396411eb19266c5ca1f11fa

SHA256
a4b7657f4a3f32b62aca1815d2b0e54230ee70dd706c05498528405082b8c4ed

SHA512
ff25eda7d2a0f5b80da62c17ea915a515c0b78aba6f6c38c86bbd11d47c3bbd8909479f60813f2de1a33660cce8f02c2286568d78150d64874e40a0930b6c195

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d2c060be1e01cfab09a18ea34e3f5222

SHA1
b40101eb0c39e21e72afa2ca315729c9c259cec5

SHA256
e10a422df6ede640eb4a3903bc433deb440723fcdb69526a2d457a477d056902

SHA512
430f54f01c39e211cc2d6df40c8b5d7e3ea7cfc69b8b3fab639ca720be5a15711fa27af569235c460c7a8fe74c5fdf8144a3c1d7605cabf42edcc24ad5f37f9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ee11faff7043dbdc12b6c46069de15fc

SHA1
29e7cf7c96ccd61d7ed05aacfe988c29c427b12c

SHA256
e91c904c75b5407069fb24cc8b6362ea5a45c627a50c3f8be8d409278be5b535

SHA512
3db98388ba1e4bde1c736d0b27011ac0ca125998b3c3f88a4d6e84328b6a1b4fc3b5c5c750c766ca891560e7bc4ee64f15af55bf884c15da17631fb814a26bae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0e1a4ca9083f80bbda81cdb3d28b47d9

SHA1
a2072e810546bdc62d74664165efe16a07cdca22

SHA256
168d3a7d19b1e7e1f4f3f3c9b5dc17e5163cd1109244c083827486b7d5247f23

SHA512
114c29cf5247796544543937c3ff3afea0ed2a72f3a9018ab6072b29c4de3a3ecc7a7dbe7e85e8d237db9a3da08884fb9ca505791630642f984444645ac87590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bbf60be64b44100a015c324463b66847

SHA1
5d252c1c04a6690ede361f5c11e4ebbeb2733ea4

SHA256
73e293f7375dcfd2f818d4af3493a1db28b9bf700c81df8ca49d76a6f441fe71

SHA512
04e39f36e776e61819bed0c236e08078a88508a7c49e467e089837ec2b2fe7dd7e9d6979e7ccc49e53dfb6fed51794110b16c56037b5156bfd04f24818b98271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
47a1349f5fd851d4834e85f3156eb11b

SHA1
efeeb7bdae79908ea2d414206b6d1d609f3d53db

SHA256
10d0ae8ac9b0059a3342e97265b85ac06c460cdde537bac73c85e081b2e0343c

SHA512
f8d8e887db5f331fa5b09dfcc6fed07edc9d6eebda5aef725eae887ebb28cb8e7bb36da7872bf30b6082a76f13663fffffaec98be23435f03b784aa2b36b297d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
34f06bc23cb2bf46a34845d37fa55216

SHA1
17b33b054b0a1e7bb8f2e50bf52e06e8c06559f5

SHA256
20539032a14587f8ee10b46c7fe3626fefba37cf669b5e74c09fb68b46ceb93c

SHA512
648116de3c6a2fb8413be4f1a1879b274f04d9bb716e89b33dbc0679f19e1bd4025a047e4ca5fc4d61b857d522397e00ef749247715a510eaa94ced5acfd3bf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
658a0a330615f3e01a73dcc981e0bd89

SHA1
6dcb303e27a938f5543b0290832de6b92e757657

SHA256
e770eed9fd21822209721a514e4679fed65246f86ac059e399db5dfacd7b0a2e

SHA512
55ded362a5e756e7145f08ceb5467cb7c2b7292c88c459575ea7dad55e13de0ce6ca08d30e7220278ea91d9723f1c42d16a245f66385b29bac8e178b20cc4e1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8b10e669cc631080a56b55cd5361decc

SHA1
ffe2f147b20c7c75027635725dc61bca0563b6d3

SHA256
50f2b5d4f5e7958d1ef8493f569d391e348ccf53bba0d552bae4a8e64dd13c49

SHA512
5b39cf74a6eb644c14d4a725adbac1adb2ce76a82b6bb35844128779b66bd9cb0c5d8934d5dacf2290ab7fd25bbda66ab6e88e92e4233df051a1293cdf129bf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584b6c.TMP

Filesize
706B

MD5
61a5f3c9ef0a2389293aaf7a35f344c7

SHA1
fcdd4aacde058553eb55d4dd1886b29e682b1ef6

SHA256
2636b1c53c07f6b552c3189701f9bea811622080f90d0f2b138178a163cdf56b

SHA512
8338f735bac49e8180030a60f0dc45f44948c5e31be1b1c2bfb365f9911f69b73e0d3c4350a839e6bd2f4578c0246c8b2d807b089cf79dbda7f59d304632003a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
72cd4c70cb3a68712a05e95562b9762b

SHA1
a133036d4d4efbbca34f4fb2e648e55ccef71e41

SHA256
4d55144a955516c447b477dfaba84c430a76df1bdb7357989efd662519367261

SHA512
95eb87e52ae14e35bb2dc912c73105f9785ce8216e739db50becc90591156f64894ae8a764290b43cceb63e0220a651caf919f223400f753a7edfa5551d394e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b833c9c816f6bc4f139903ba8acf8468

SHA1
2bc8b64a62964d7bdfb644c4e2692898e0a90bbd

SHA256
da6f2d593af91fb108e35d80bd097cc735f09dac7e44770ecef97832aa8ee55a

SHA512
abce09c3142086afc81fd019700140fdc8c789e523c1165149628d325a8eed3e0a0240b3914ea7be93d27a0f43f741f83a2b40fb4842d04d35179b29d1ee8340

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
20f97cb977a7cef1b6f52200dd2a01a3

SHA1
4f5a640724b4df3a0f3e8d01aff5692f2341ad62

SHA256
7a6b9dcefd6ba52095bd87e6838c9b128cd6cf188f28c802a8ed9046b1f73a05

SHA512
2a63a622c7db5d65ded21a5ce816e2d0df8466b537d0889f3ca75f02ff9ebeadf15df3c38cb281ab45d5004bd9b67360db3d058af2b6bdd0ebca894a2a02a477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
42b5c8694fbbf0bf4bb6c92a89e5f603

SHA1
803b4f3e450a8e6eaf65a9bda162eb4201f37487

SHA256
5e0cf98694b88454e1b228af33ba3f6692d35d8d429405754b748fa9b7477fd6

SHA512
fea9ea9f7cc46e33a15bb0df313939157aa3a2b47e6cd5ef52a0347866871de73c488b1712adb66ad94ce7f48bad056da95a3bab8b4fc268b0c6464f5723a5f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
71dbe071a180f9314684abf0f615c438

SHA1
9b3cbdfff5789a9b6e2562ffc8703688fa36c09f

SHA256
ed630101326359a89066db7859410e1a67c6dda015cd0c06dccb896715ec54f1

SHA512
d1ee07a5e742294badbbb01fffefd010b3a521cecaa6150b02c70e51d71780ae099dcf41a94e16e37bc246686b13d5c7f58af180bb83a8d383b64411a310c1b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8130e25d9059dd7454be5dcf1f9e0b68

SHA1
60749e952edbe14796f013d37d04187a5596007d

SHA256
76fd9903c95e91d032be56e1548187f9b31ac2518d7acbeed5ac7b665a530f3c

SHA512
bff36510f7693d53c7364f5703ab9d7fdd1859517b57bc1bba7c76a1e9798f10fdd901198209e9be939b595a2a37829773d0540647bfda3f347b3edbff0c8c21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
eae08f158d1e8aa2208fcf3f5f362e9b

SHA1
fbc2600550854571fd5b0399532e41bd0f6ce28e

SHA256
6dafa135d215373985a8e2e137b0487554f1d4fe6dbf16765081898cc63a7d27

SHA512
e986ea59bdb0f5b9bf209f1871c53a43e0c66f8b6a3b761ad9cd4b4fe60ad04c595c28a944fee0eff77bdb2f2afca393224e4af1eb27d41bb574e5333482dc08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

Filesize
4KB

MD5
bbcad3fd91a5fa54ab98025d8d266108

SHA1
8a4685df63dbf48c31e0072b2d32ce69efcb939f

SHA256
bdee958842146388f5854f666057c06b1664d7788604584d49111b24340767f2

SHA512
f5f8fc73b265aee6bc90c23f02e77f3837981becce29523b3827d6591ef953d1c830c41bb1c54a46b7a3f8df28cb2ef492c8ac69d0dcaffe64b443ab044d523d

Download Submit
C:\Users\Admin\AppData\Local\Temp\0rnevxn9.0.vb

Filesize
355B

MD5
acd609faf5d65b35619397dc8a3bc721

SHA1
ba681e91613d275de4b51317a83e19de2dbf1399

SHA256
4cfd86d51d0133dda53ba74f67ffe1833b4c0e9aae57afe2405f181fc602f518

SHA512
400ffd60ce7201d65e685734cea47a96abca58ca2babda8654b1d25f82d2766ca862a34f46c827249a4dc191d48f56005a9f242765d7becdda1344b8741a9d8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\0rnevxn9.cmdline

Filesize
224B

MD5
6e4735ca82bdb851d91310bae13b3bcf

SHA1
238d9149fcddaa4d720296ff01cd9a48dc653705

SHA256
084b2b2da15a35cd7fd902e0c50ecfe8d5f6dbf1860a3d1a55ee727a926469bf

SHA512
f4a1eb83068fb57862dcf00f0c4c16558c0e6892da29776430917a12ecf773a9cdbe2fdecb20ae296c1c71e19980a6073a73033945679bda26cdc6c69e72bd4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5139.tmp

Filesize
5KB

MD5
3cf437f4e880dc8dc1869547d29a3762

SHA1
a9c9894e09cc14171cb298691396943a3b73eb6e

SHA256
c592319558771bd6b64288d0e880de7bc8ab8a3fa317d42215dfbb6ae52edad3

SHA512
9843a312289c5a222aa7250970c933b192bb93735d43563f2484a23b7949370f9f3f4cfe36b53c7edc30de7228362c3b4030ba4c7a4cda28a9a4e8247721e181

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES533D.tmp

Filesize
5KB

MD5
cbca0aec62308cb11ec68bac10b42f27

SHA1
48f38486c0fbbb61638709fcb591e7182649d1b1

SHA256
9b678b507dd5869a2247fd8796584585fcc09ba502b15e7e08c50bf3ad55be16

SHA512
44f32acb9703c90e008cde2cfd2324c1acd1221a1d98b0e409dfb67d5a418f69d2ce51277982af1ecb2826bff668d4890817052b10ac1db5087d19d33b66db49

Download Submit
C:\Users\Admin\AppData\Local\Temp\ands.dll

Filesize
30KB

MD5
d4a7e2883571bd5aadc8c42e7dde6288

SHA1
90d06ccbcfa36ed581a9a9af5f3581dc36387746

SHA256
787b25dc26dc474d9a6a8afe13c20ec3db2d204b390c399029c92da3dbbbdd40

SHA512
a204f3be5a0a95c3b6126473b6079965386c4a66d59bc0bbb40772141b65775d7db60b01caced38796c66d2bf7a6d23e8dd4970d7a9a5d40901ac19477d25714

Download Submit
C:\Users\Admin\AppData\Local\Temp\kxjgvrju.0.vb

Filesize
369B

MD5
83f6067bca9ba771f1e1b22f3ad09be3

SHA1
f9144948829a08e507b26084b1d1b83acef1baca

SHA256
098cd6d0243a78a14ce3b52628b309b3a6ac6176e185baf6173e8083182d2231

SHA512
b93883c7018fdd015b2ef2e0f4f15184f2954c522fd818e4d8680c06063e018c6c2c7ae9d738b462268b0a4a0fe3e8418db49942105534361429aa431fb9db19

Download Submit
C:\Users\Admin\AppData\Local\Temp\kxjgvrju.cmdline

Filesize
253B

MD5
5019bdcf2e9097feb9d1f1f9e9208546

SHA1
612431d17ea7ec5e3cf67122e24987ba08c1551b

SHA256
08723a2295d3c54b9152082f793c534a68d735954d8a08332be34ae3f3d1428b

SHA512
47961742f1cb2f6db8cfe9926e955c2d65a7d1c61184e9322f6b76ac47dc928e700b3189ace6502611459edd36fbe101fa2c335477507e6383a32f1c1da118eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\u4phbzud.0.vb

Filesize
369B

MD5
e4a08a8771d09ebc9b6f8c2579f79e49

SHA1
e9fcba487e1a511f4a3650ab5581911b5e88395d

SHA256
ef4c31d167a9ab650ace2442feeec1bf247e7c9813b86fbea973d2642fac1fb6

SHA512
48135e0de7b1a95d254ae351ccac0cb39c0d9a46c294507e4bf2b582c780c1b537487161396dd69584c23455950f88512e9931dbff4287c1072938e812a34dd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\u4phbzud.cmdline

Filesize
253B

MD5
d5ce4a332cbab4994828faf1739d8c8d

SHA1
faa773912c4f7186eb793b7b31fa8af4625da96c

SHA256
acd075b843555a3b6226a1a0451aa8c4dca71fc2be5aa997fb28b1473640723e

SHA512
1bd1e29bd5bcb3fe8f717ab99cdf2c6509d0e8b56d1d3120de9f4d547149e38cd09eefff89d021bdd00cba77270779ae05ace5d1df1631a90653971b308991db

Download Submit
C:\Users\Admin\AppData\Local\Temp\uRClgZblR.txt

Filesize
39B

MD5
502984a8e7a0925ac8f79ef407382140

SHA1
0e047aa443d2101eb33ac4742720cb528d9d9dba

SHA256
d25b36f2f4f5ec765a39b82f9084a9bde7eb53ac12a001e7f02df9397b83446c

SHA512
6c721b4ae08538c7ec29979da81bc433c59d6d781e0ce68174e2d0ca1abf4dbc1c353510ce65639697380ccd637b9315662d1f686fea634b7e52621590bfef17

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc358A55D73A9143C689A7A4304F892057.TMP

Filesize
644B

MD5
dac60af34e6b37e2ce48ac2551aee4e7

SHA1
968c21d77c1f80b3e962d928c35893dbc8f12c09

SHA256
2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

SHA512
1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc4C591B70995547A59E65919AAFAF55AE.TMP

Filesize
5KB

MD5
abeaa4a5b438ffa58d07d9459e5c1d6c

SHA1
69631de7891162dd4840112a251f6531feae7509

SHA256
ce174412cb2889bbf162b7ebe4476da5a9c928ba5b13111d338753ccc4c0f5fd

SHA512
c9cae8bcc14661e993d97a3c7b658310a8b9c19044817589f92eab66f1bcfcecb3468b0de8b45cd68e218c23cd9c60aeef1d391af36ec03afab5c8b86d7937d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc5145E9382F3149FD8B6E933BF98FB9BA.TMP

Filesize
5KB

MD5
249d49f34404bfbe7ed958880be39f61

SHA1
51ec83fb9190df984bf73f2c5cd1edc0edf1882a

SHA256
fcb5a4d24f24fbeaf4dc9d8e29f2701b2bb71411acb13c4fa67fe7025892912b

SHA512
082f47f59b9184dd6c88f64214e10b82656a09c5a5cf3f0eccbf7935505db473eeb9a395cb5b59ec5009e731f2aa1891670c94ff6315a0b2d4fcc0392cff0e98

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc6F9F510A4B7F436F8DC952E3AEFCDF1.TMP

Filesize
5KB

MD5
d01de1982af437cbba3924f404c7b440

SHA1
ccbd4d8726966ec77be4dbe1271f7445d4f9b0ce

SHA256
518d9922618db6eea409cee46b85252f0d060b45c2f896cb82eeca22eb715598

SHA512
a219cd3df17bcf16cb57bdeea804e206a60be50084e2cb99d6d5e77d88957d79535d110b34735a4b549d3fcae528cdff8bfa5286582028ef22e8b4d60e146878

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc9E8F356FAFFD4E3B8267819476B6519.TMP

Filesize
668B

MD5
3906bddee0286f09007add3cffcaa5d5

SHA1
0e7ec4da19db060ab3c90b19070d39699561aae2

SHA256
0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

SHA512
0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcA8E9013E800A44C2A96A1AADD2C5F792.TMP

Filesize
676B

MD5
85c61c03055878407f9433e0cc278eb7

SHA1
15a60f1519aefb81cb63c5993400dd7d31b1202f

SHA256
f0c9936a6fa84969548f9ffb4185b7380ceef7e8b17a3e7520e4acd1e369234b

SHA512
7099b06ac453208b8d7692882a76baceec3749d5e19abc1287783691a10c739210f6bdc3ee60592de8402ca0b9a864eb6613f77914b76aec1fc35157d0741756

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
472B

MD5
1bb6ec451945667dc6e987ea8017c0bf

SHA1
83989e238ff7b378313d7a3f76d25e248767c0b0

SHA256
465f8215a4b98945188a67b6587eabeb465023a45603d2e1d4b6d71dcbeab1b7

SHA512
545b6c990b02e65575126d5b6159ab1b62f3fa7f05f99dfd2062b11093f5d24460844ffe14ccbb20e3b37dad84be7800bd4b57a04e0c7fe5ffa4627192bc6f5d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
424B

MD5
cc2ad41ae834a40cd257fb26a390ee26

SHA1
30787c41575e0cbaad8b44981a69ca404ae2d33c

SHA256
a8d6756c3be73ecfd81bf85d1c7ceab865d9ed19ddca9b5851e348c399672bbb

SHA512
c9895645350a371cf348613a13a8009e5d92a8b1a71041947fc5f5a145be68485631f9b9fb3382b11427c7ca7efb63d5ae8cdfa36481294adb5db7ff69043680

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
8KB

MD5
241afd6d8c9b757512c531c411a80474

SHA1
643cfcf82d1e248102290aeb18ee5a12c21add04

SHA256
724dcd43a4e3216ffd75f46136b99371e94046e777109ac3f22a95bea5b18d2b

SHA512
d7920e334db0bcf9c8211c56d501dd6e1e0159c0d148b07a3ed16c68158a824ce77f389cd087cfab6f8a02f61b73fb9fd944475a60e1e68c25b16fc5fb8ebd52

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
5KB

MD5
f1300fcd311585556d146ff611bbc2a3

SHA1
0955b42416e0c7c9911d997e96c7e66c01ce2835

SHA256
7787cb5adcf425e1b8ce9645b3c9aeb9df8478d76d567222123e6a8b4eb25e9b

SHA512
2242d37151b5c58e308b84be9ea6fb1f099fd36379c98b2578311946f12f11ed6258118e64353a7bfc42c41004caf2769841a5830939aa2c6b169a856920e364

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
4KB

MD5
26ebb740f279128fda91dcb41ce0db4f

SHA1
9e8e69cf902c7a43b81094469773b2b704b8200c

SHA256
78d062ede56f2e59eb1c499f86dd0c0d31a15209444222e4ba99e3f3637afa1a

SHA512
f0d76ecd25a3c3cab4fadff439125ec8dd8f63e8438cb117cde7d7f27a533b75fc0309c0452944330d43753ab57052a0cf9910e46577399d86ad531c9abafda1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
4KB

MD5
bed612bbec484c183431fd0887e64670

SHA1
c05924592c499dc8172aa02e33b868b998bcd39f

SHA256
547fb9b570defa88bee16dbdafdb319c5cdc7fe157d89a54402aa24e47be920e

SHA512
cf0abd295b3110146309493c6c35f4380e130a04943238516ec87a967d90b0b6be872661c62ca3fb2737d61c0e8c83db593a4878720724294b2cafc3307e9917

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
4KB

MD5
4e57b177b8ab50e28e13232389a2f6f6

SHA1
effc74cb6c08f113114216ce81043b389c0ef0c5

SHA256
e3e198130ea3ccea9403973fe1ce9470e9513fc5471e3e1ea2aa229ab7329fbf

SHA512
a83d90cfed358c7d01c4eb9abe70cfe33dc38d1e9dbefa20512788a683c211979ae47314673c7045119cc8825192821076ae658532913c030133cafd78c77a5a

Download Submit
C:\Users\Admin\Downloads\CobaltStrike.doc

Filesize
86KB

MD5
96ff9d4cac8d3a8e73c33fc6bf72f198

SHA1
17d7edf6e496dec4695d686e7d0e422081cd5cbe

SHA256
96db5d52f4addf46b0a41d45351a52041d9e5368aead642402db577bcb33cc3d

SHA512
23659fb32dff24b17caffaf94133dac253ccde16ea1ad4d378563b16e99cb10b3d7e9dacf1b95911cd54a2cad4710e48c109ab73796b954cd20844833d3a7c46

Download Submit
C:\Users\Admin\Downloads\NetWire.doc

Filesize
7.3MB

MD5
6b23cce75ff84aaa6216e90b6ce6a5f3

SHA1
e6cc0ef23044de9b1f96b67699c55232aea67f7d

SHA256
9105005851fbf7a7d757109cf697237c0766e6948c7d88089ac6cf25fe1e9b15

SHA512
4d0705644ade8e8a215cc3190717850d88f4d532ac875e504cb59b7e5c6dd3ffae69ea946e2208e2286e2f7168709850b7b6e3b6d0572de40cfe442d96bba125

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 130100.crdownload

Filesize
4.0MB

MD5
1d9045870dbd31e2e399a4e8ecd9302f

SHA1
7857c1ebfd1b37756d106027ed03121d8e7887cf

SHA256
9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

SHA512
9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 718796.crdownload

Filesize
116KB

MD5
41789c704a0eecfdd0048b4b4193e752

SHA1
fb1e8385691fa3293b7cbfb9b2656cf09f20e722

SHA256
b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23

SHA512
76391ac85fdc3be75441fcd6e19bed08b807d3946c7281c647f16a3be5388f7be307e6323fac8502430a4a6d800d52a88709592a49011ecc89de4f19102435ea

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 739813.crdownload

Filesize
31KB

MD5
29a37b6532a7acefa7580b826f23f6dd

SHA1
a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f

SHA256
7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69

SHA512
a54e2b097ffdaa51d49339bd7d15d6e8770b02603e3c864a13e5945322e28eb2eebc32680c6ddddbad1d9a3001aa02e944b6cef86d4a260db7e4b50f67ac9818

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 840581.crdownload

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 899226.crdownload

Filesize
5KB

MD5
fe537a3346590c04d81d357e3c4be6e8

SHA1
b1285f1d8618292e17e490857d1bdf0a79104837

SHA256
bbc572cced7c94d63a7208f4aba4ed20d1350bef153b099035a86c95c8d96d4a

SHA512
50a5c1ad99ee9f3a540cb30e87ebfdf7561f0a0ee35b3d06c394fa2bad06ca6088a04848ddcb25f449b3c98b89a91d1ba5859f1ed6737119b606968be250c8ce

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 899226.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 901159.crdownload

Filesize
756KB

MD5
c7dcd585b7e8b046f209052bcd6dd84b

SHA1
604dcfae9eed4f65c80a4a39454db409291e08fa

SHA256
0e8336ed51fe4551ced7d9aa5ce2dde945df8a0cc4e7c60199c24dd1cf7ccd48

SHA512
c5ba102b12d2c685312d7dc8d58d98891b73243f56a8491ea7c41c2edaaad44ad90b8bc0748dbd8c84e92e9ae9bbd0b0157265ebe35fb9b63668c57d0e1ed5f2

Download Submit
C:\Windows\BreakTart

Filesize
47B

MD5
081c6d16a42da543e053d56b41e011a4

SHA1
7c3b4b079e17988aef2deb73150dda9f8b393fdc

SHA256
7a4a7fc464c0e33f4959bbfad178f2437be9759ec80078a1b5b2f44656830396

SHA512
5a65a2b81c0d001be174a100363adae86bdc9af02360fbd2c87ebdb45d62833104e4cca90473f1156792473af5922e947677585c55052a99868e6a395aa457ff

Download Submit
C:\Windows\_CutButterball

Filesize
2KB

MD5
aa6e5b169c310684d6bc5ac0a3692b73

SHA1
3bd8ada1c28a67c30c5f5cf99e8f8f83afd4e6da

SHA256
0a19cf359e14817f1b1a675a2a969f5e4e03f30cafac1b3e447699926a814e7f

SHA512
3fbfd06f156e81027f2ac9f784a90cb7023db6182fc55f58e2e9276c0d3c548e8e36c68ff8fbbc14ad08c5228ca34831b504e02c2162d02ed6f06762e1617f6d

Download Submit
C:\Windows\_CutButterball

Filesize
4KB

MD5
8d2913bc4e6360a555ac365a4e783c77

SHA1
a11ab7e55b99b7cb39b0f8d2a1edeed244c1ab5c

SHA256
f577adf362368ed1b285f49117a80db868769aca651bdddeb51001633198c1b8

SHA512
0f0af006a161215fe84949405a5c9acfd2eb476b81cb26189caa81796da78c4e15b6398fe4cbc93836139d4681a4e6af3ff04f34ba8a911f13aad44d3cc7edc1

Download Submit
C:\Windows\_CutButterball

Filesize
64KB

MD5
ce4e4b69a0e2c5dd7e7a8d23d0134641

SHA1
ea257a983297a10ed11501c7b6550f246b4c3187

SHA256
eae1798de34d5183560ab8935607cb8e0bd629afde5e615e72b196db30cf49f6

SHA512
e535cbdea5af34692527a3f6fac0b224b543fb571a8b0ea1637140e9dabd1f705719463f50254d096e2c2a4f4c2b1a6b2ad93061072ceaa0881c35a8375518c6

Download Submit
C:\Windows\_CutButterball

Filesize
64KB

MD5
7cbf3845067a39d3207feacd221cc97f

SHA1
68ba9114b4d0aa6d156ce7e871fd12b2d436dfa3

SHA256
9590df4ec9ec58738dddba814c100747890183897c0542d4fb8ce0906500fdbf

SHA512
7af206028386df9075d05766ec00b18504003c14f869c4a46969f761d189b9771c7be03133375cc69fec721a315eb22c136be3433da8679df4e13b9a01e54aa6

Download Submit
C:\Windows\_CutButterball

Filesize
128KB

MD5
ef0fa04dccc24376670d0f230d53c713

SHA1
705d527b8b5f97a4e5d4a4724addfdf6f251a2ad

SHA256
cee0083c73db58fcbd0be38c33e297cd1bee9141c4451540cfb91a03c6d5cceb

SHA512
c251d02c19bb528a9bf109d89405b36fd427fb1e90a2cffd66b7bcc8bf866e977a89d02cd2df06a906b9430768b4883ed61793782732d524f61f412e9312176d

Download Submit
C:\Windows\_CutButterball

Filesize
128KB

MD5
0e0fc6a355696aab1b22b59c30a27603

SHA1
89a39f95bcfa184b173499e8294b2a05bff4515e

SHA256
481781cc026930fe77904cebb38799e1d247248ddc813e800986b0dace22143c

SHA512
0b43c5feacda22bc2f8fb06f8d34bef1ec18fe7f699d0e134e3151cce116fca42a73fc12e14ebc55bef2ff8690f184d5e2dd3721fb0c826e2ba390ea7eba7e14

Download Submit
memory/220-58560-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/1268-635-0x0000026FFE310000-0x0000026FFE4B9000-memory.dmp

Filesize
1.7MB

Download
memory/1268-602-0x0000026FFB9F0000-0x0000026FFBA0E000-memory.dmp

Filesize
120KB

Download
memory/2148-963-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2152-677-0x00000165A9480000-0x00000165A9629000-memory.dmp

Filesize
1.7MB

Download
memory/2816-681-0x000001DC576F0000-0x000001DC57899000-memory.dmp

Filesize
1.7MB

Download
memory/2816-636-0x000001DC54F40000-0x000001DC55854000-memory.dmp

Filesize
9.1MB

Download
memory/3112-961-0x000000001CA40000-0x000000001CAA2000-memory.dmp

Filesize
392KB

Download
memory/3112-959-0x000000001C350000-0x000000001C81E000-memory.dmp

Filesize
4.8MB

Download
memory/3112-960-0x000000001C8D0000-0x000000001C976000-memory.dmp

Filesize
664KB

Download
memory/3344-834-0x00007FF8567A0000-0x00007FF8567B0000-memory.dmp

Filesize
64KB

Download
memory/3344-833-0x00007FF8567A0000-0x00007FF8567B0000-memory.dmp

Filesize
64KB

Download
memory/3344-831-0x00007FF858890000-0x00007FF8588A0000-memory.dmp

Filesize
64KB

Download
memory/3344-828-0x00007FF858890000-0x00007FF8588A0000-memory.dmp

Filesize
64KB

Download
memory/3344-829-0x00007FF858890000-0x00007FF8588A0000-memory.dmp

Filesize
64KB

Download
memory/3344-830-0x00007FF858890000-0x00007FF8588A0000-memory.dmp

Filesize
64KB

Download
memory/3344-832-0x00007FF858890000-0x00007FF8588A0000-memory.dmp

Filesize
64KB

Download
memory/4620-964-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/5068-700-0x000002786FC10000-0x000002786FDB9000-memory.dmp

Filesize
1.7MB

Download
memory/5948-285470-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/5948-303216-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/6228-55570-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/6328-64339-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/6972-67347-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/7400-69758-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download
memory/7852-58509-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/8048-60951-0x0000000013140000-0x000000001320F000-memory.dmp

Filesize
828KB

Download