dcrat | hxxps://github[.]com/ByterCode/GameHackLoader/raw/refs/heads/main/GameHackLoader[.]zip

Resubmissions

31-10-2024 16:41

241031-t7k8lazkgs 10

31-10-2024 16:25

241031-twydsa1gpn 10

31-10-2024 16:05

241031-tjfyzasndj 10

Analysis

max time kernel
30s
max time network
69s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
31-10-2024 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ByterCode/GameHackLoader/raw/refs/heads/main/GameHackLoader.zip

Score

10^/10

dcrat discovery execution infostealer persistence rat

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Modifies WinLogon for persistence 2 TTPs 13 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

RunShell.exeMpRunShellHost.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\setup.exe\", \"C:\\Windows\\ja-JP\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\smartscreen.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Program Files\\Windows Photo Viewer\\msedge.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\setup.exe\", \"C:\\Windows\\ja-JP\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\smartscreen.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Program Files\\Windows Photo Viewer\\msedge.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\setup.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\setup.exe\", \"C:\\Windows\\ja-JP\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\smartscreen.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Program Files\\Windows Photo Viewer\\msedge.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\setup.exe\", \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\Install\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Common Files\\explorer.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\setup.exe\", \"C:\\Windows\\ja-JP\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\smartscreen.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Program Files\\Windows Photo Viewer\\msedge.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\setup.exe\", \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\Install\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Common Files\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\MpRunShellHost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\dwm.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\setup.exe\", \"C:\\Windows\\ja-JP\\lsass.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\setup.exe\", \"C:\\Windows\\ja-JP\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\smartscreen.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\setup.exe\", \"C:\\Windows\\ja-JP\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\smartscreen.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\setup.exe\", \"C:\\Windows\\ja-JP\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\smartscreen.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Program Files\\Windows Photo Viewer\\msedge.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\setup.exe\", \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\Install\\backgroundTaskHost.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\setup.exe\", \"C:\\Windows\\ja-JP\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\smartscreen.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Program Files\\Windows Photo Viewer\\msedge.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\setup.exe\", \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\Install\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Common Files\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\setup.exe\", \"C:\\Windows\\ja-JP\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\smartscreen.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Program Files\\Windows Photo Viewer\\msedge.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\setup.exe\", \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\Install\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Common Files\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\MpRunShellHost.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\setup.exe\", \"C:\\Windows\\ja-JP\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\smartscreen.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\winlogon.exe\", \"C:\\Program Files\\Windows Photo Viewer\\msedge.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\setup.exe\", \"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\Install\\backgroundTaskHost.exe\", \"C:\\Program Files (x86)\\Common Files\\explorer.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\MpRunShellHost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\dwm.exe\", \"C:\\Users\\Public\\Documents\\My Videos\\Idle.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\setup.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\ja-JP\\setup.exe\", \"C:\\Windows\\ja-JP\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\smartscreen.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\""	MpRunShellHost.exe

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5544	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5552	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5612	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5716	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5844	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5860	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5900	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5920	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5952	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5996	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6040	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6076	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6080	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6124	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6140	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1188	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5240	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5280	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6096	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6088	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5200	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5228	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5344	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5188	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5316	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5368	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5384	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5616	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5608	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5624	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5456	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5820	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5480	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5532	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5696	2080	schtasks.exe	106
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5540	2080	schtasks.exe	106

DCRat payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/5264-329-0x00000000012A0000-0x0000000001372000-memory.dmp	family_dcrat_v2
behavioral1/files/0x00290000000451b2-361.dat	dcrat
behavioral1/memory/5516-364-0x00000000002D0000-0x0000000000436000-memory.dmp	dcrat
behavioral1/memory/6472-492-0x000000001B830000-0x000000001B902000-memory.dmp	family_dcrat_v2

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
5352	powershell.exe
1524	powershell.exe
5888	powershell.exe
5824	powershell.exe
5464	powershell.exe
5344	powershell.exe
5904	powershell.exe
5872	powershell.exe
5844	powershell.exe
5868	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WinHelper32.exeWScript.exeMpRunShellHost.exeRunShell.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Control Panel\International\Geo\Nation	WinHelper32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Control Panel\International\Geo\Nation	MpRunShellHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Control Panel\International\Geo\Nation	RunShell.exe

Drops startup file 1 IoCs

Processes:

javaw.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper32.exe	javaw.exe

Executes dropped EXE 3 IoCs

Processes:

WinHelper32.exeMpRunShellHost.exeRunShell.exe

pid	Process
6068	WinHelper32.exe
5264	MpRunShellHost.exe
5516	RunShell.exe

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

MpRunShellHost.exeRunShell.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smartscreen = "\"C:\\Recovery\\WindowsRE\\smartscreen.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\WindowsRE\\winlogon.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Common Files\\explorer.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setup = "\"C:\\Windows\\ja-JP\\setup.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\dwm.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Program Files\\Windows Photo Viewer\\msedge.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setup = "\"C:\\Program Files (x86)\\Microsoft.NET\\setup.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Common Files\\explorer.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\ja-JP\\lsass.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smartscreen = "\"C:\\Recovery\\WindowsRE\\smartscreen.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\WindowsRE\\winlogon.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\Public\\Documents\\My Videos\\Idle.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\Install\\backgroundTaskHost.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MpRunShellHost = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\MpRunShellHost.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MpRunShellHost = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\MpRunShellHost.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setup = "\"C:\\Windows\\ja-JP\\setup.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\ja-JP\\lsass.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Program Files\\Windows Photo Viewer\\msedge.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setup = "\"C:\\Program Files (x86)\\Microsoft.NET\\setup.exe\""	RunShell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate_bk\\Install\\backgroundTaskHost.exe\""	MpRunShellHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\dwm.exe\""	RunShell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\Public\\Documents\\My Videos\\Idle.exe\""	RunShell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

Processes:

flow	ioc
24	raw.githubusercontent.com
59	raw.githubusercontent.com
60	raw.githubusercontent.com
23	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

Processes:

csc.exe

description	ioc	Process
File created	\??\c:\Windows\System32\CSC7BA86940BA38418495C060624C129686.TMP	csc.exe
File created	\??\c:\Windows\System32\fgih3v.exe	csc.exe

Drops file in Program Files directory 13 IoCs

Processes:

RunShell.exesetup.exeMpRunShellHost.exe

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\7a0fd90576e088	RunShell.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\f9089a0d-a6f8-4057-a847-0c7d8786442b.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241031164216.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\backgroundTaskHost.exe	MpRunShellHost.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\eddb19405b7ce1	MpRunShellHost.exe
File created	C:\Program Files\ModifiableWindowsApps\msedge.exe	RunShell.exe
File created	C:\Program Files\Windows Photo Viewer\msedge.exe	RunShell.exe
File created	C:\Program Files (x86)\Microsoft.NET\setup.exe	RunShell.exe
File created	C:\Program Files\Windows Photo Viewer\61a52ddc9dd915	RunShell.exe
File created	C:\Program Files (x86)\Microsoft.NET\826420e65ec10f	RunShell.exe
File created	C:\Program Files (x86)\Common Files\explorer.exe	RunShell.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\dwm.exe	RunShell.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\6cb0b6c459d5d3	RunShell.exe

Drops file in Windows directory 5 IoCs

Processes:

MpRunShellHost.exe

description	ioc	Process
File created	C:\Windows\Boot\DVD\EFI\en-US\backgroundTaskHost.exe	MpRunShellHost.exe
File created	C:\Windows\ja-JP\lsass.exe	MpRunShellHost.exe
File created	C:\Windows\ja-JP\6203df4a6bafc7	MpRunShellHost.exe
File created	C:\Windows\ja-JP\setup.exe	MpRunShellHost.exe
File created	C:\Windows\ja-JP\826420e65ec10f	MpRunShellHost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

GameHackLoader.exeWinHelper32.exeWScript.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameHackLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHelper32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 4 IoCs

Processes:

msedge.exeWinHelper32.exeMpRunShellHost.exeRunShell.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings	WinHelper32.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings	MpRunShellHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000_Classes\Local Settings	RunShell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

pid	Process
5228	schtasks.exe
1664	schtasks.exe
5188	schtasks.exe
5552	schtasks.exe
5860	schtasks.exe
5368	schtasks.exe
5316	schtasks.exe
5544	schtasks.exe
5716	schtasks.exe
5952	schtasks.exe
6140	schtasks.exe
5280	schtasks.exe
6096	schtasks.exe
4440	schtasks.exe
5616	schtasks.exe
5624	schtasks.exe
5540	schtasks.exe
5844	schtasks.exe
5996	schtasks.exe
6076	schtasks.exe
5240	schtasks.exe
5480	schtasks.exe
5612	schtasks.exe
5920	schtasks.exe
1188	schtasks.exe
5344	schtasks.exe
5608	schtasks.exe
6040	schtasks.exe
6088	schtasks.exe
5384	schtasks.exe
3036	schtasks.exe
5456	schtasks.exe
5696	schtasks.exe
5900	schtasks.exe
6080	schtasks.exe
6124	schtasks.exe
5200	schtasks.exe
5820	schtasks.exe
5532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exepowershell.exepowershell.exeMpRunShellHost.exe

pid	Process
4336	msedge.exe
4336	msedge.exe
4304	msedge.exe
4304	msedge.exe
4748	msedge.exe
4748	msedge.exe
3228	identity_helper.exe
3228	identity_helper.exe
5352	powershell.exe
5352	powershell.exe
5344	powershell.exe
5344	powershell.exe
5352	powershell.exe
5344	powershell.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe
5264	MpRunShellHost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

msedge.exe

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

Processes:

powershell.exepowershell.exeMpRunShellHost.exeRunShell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	5352	powershell.exe
Token: SeDebugPrivilege	5344	powershell.exe
Token: SeIncreaseQuotaPrivilege	5344	powershell.exe
Token: SeSecurityPrivilege	5344	powershell.exe
Token: SeTakeOwnershipPrivilege	5344	powershell.exe
Token: SeLoadDriverPrivilege	5344	powershell.exe
Token: SeSystemProfilePrivilege	5344	powershell.exe
Token: SeSystemtimePrivilege	5344	powershell.exe
Token: SeProfSingleProcessPrivilege	5344	powershell.exe
Token: SeIncBasePriorityPrivilege	5344	powershell.exe
Token: SeCreatePagefilePrivilege	5344	powershell.exe
Token: SeBackupPrivilege	5344	powershell.exe
Token: SeRestorePrivilege	5344	powershell.exe
Token: SeShutdownPrivilege	5344	powershell.exe
Token: SeDebugPrivilege	5344	powershell.exe
Token: SeSystemEnvironmentPrivilege	5344	powershell.exe
Token: SeRemoteShutdownPrivilege	5344	powershell.exe
Token: SeUndockPrivilege	5344	powershell.exe
Token: SeManageVolumePrivilege	5344	powershell.exe
Token: 33	5344	powershell.exe
Token: 34	5344	powershell.exe
Token: 35	5344	powershell.exe
Token: 36	5344	powershell.exe
Token: SeIncreaseQuotaPrivilege	5352	powershell.exe
Token: SeSecurityPrivilege	5352	powershell.exe
Token: SeTakeOwnershipPrivilege	5352	powershell.exe
Token: SeLoadDriverPrivilege	5352	powershell.exe
Token: SeSystemProfilePrivilege	5352	powershell.exe
Token: SeSystemtimePrivilege	5352	powershell.exe
Token: SeProfSingleProcessPrivilege	5352	powershell.exe
Token: SeIncBasePriorityPrivilege	5352	powershell.exe
Token: SeCreatePagefilePrivilege	5352	powershell.exe
Token: SeBackupPrivilege	5352	powershell.exe
Token: SeRestorePrivilege	5352	powershell.exe
Token: SeShutdownPrivilege	5352	powershell.exe
Token: SeDebugPrivilege	5352	powershell.exe
Token: SeSystemEnvironmentPrivilege	5352	powershell.exe
Token: SeRemoteShutdownPrivilege	5352	powershell.exe
Token: SeUndockPrivilege	5352	powershell.exe
Token: SeManageVolumePrivilege	5352	powershell.exe
Token: 33	5352	powershell.exe
Token: 34	5352	powershell.exe
Token: 35	5352	powershell.exe
Token: 36	5352	powershell.exe
Token: SeDebugPrivilege	5264	MpRunShellHost.exe
Token: SeDebugPrivilege	5516	RunShell.exe
Token: SeDebugPrivilege	5464	powershell.exe
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeDebugPrivilege	5872	powershell.exe
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	5868	powershell.exe
Token: SeDebugPrivilege	5824	powershell.exe
Token: SeDebugPrivilege	5904	powershell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

Processes:

msedge.exe

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

GameHackLoader.exejavaw.exeWinHelper32.execsc.exe

pid	Process
2252	GameHackLoader.exe
5192	javaw.exe
6068	WinHelper32.exe
5632	csc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 4304 wrote to memory of 2588	4304	msedge.exe	81
PID 4304 wrote to memory of 2588	4304	msedge.exe	81
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 1936	4304	msedge.exe	82
PID 4304 wrote to memory of 4336	4304	msedge.exe	83
PID 4304 wrote to memory of 4336	4304	msedge.exe	83
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84
PID 4304 wrote to memory of 2268	4304	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/ByterCode/GameHackLoader/raw/refs/heads/main/GameHackLoader.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7ffc100146f8,0x7ffc10014708,0x7ffc10014718
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15726983378361208880,4945781808032487231,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15726983378361208880,4945781808032487231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15726983378361208880,4945781808032487231,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15726983378361208880,4945781808032487231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15726983378361208880,4945781808032487231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,15726983378361208880,4945781808032487231,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15726983378361208880,4945781808032487231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,15726983378361208880,4945781808032487231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15726983378361208880,4945781808032487231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff79f275460,0x7ff79f275470,0x7ff79f275480
    3⤵
    PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15726983378361208880,4945781808032487231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15726983378361208880,4945781808032487231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:6236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15726983378361208880,4945781808032487231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:6248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15726983378361208880,4945781808032487231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1876 /prefetch:1
  2⤵
  PID:6548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15726983378361208880,4945781808032487231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1916 /prefetch:1
  2⤵
  PID:6556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4468

C:\Users\Admin\Desktop\GameHack.yzz.me\GameHackLoader.exe
"C:\Users\Admin\Desktop\GameHack.yzz.me\GameHackLoader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2252
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Desktop\GameHack.yzz.me\GameHackLoader.exe"
  2⤵
  - Drops startup file
  - Suspicious use of SetWindowsHookEx
  PID:5192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5344
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:SystemDrive) -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5352
- - C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform\WinHelper32.exe
    C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform\WinHelper32.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of SetWindowsHookEx
    PID:6068
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows\Mb2zA35gA0cosYEfu5j.vbe"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      PID:4080
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows\pzxvjMo.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
      - C:\Users\Admin\AppData\Roaming\Windows\RunShell.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows\RunShell.exe"
        6⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:5516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows\RunShell.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5464
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\winlogon.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5824
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\msedge.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5868
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\setup.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5888
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Common Files\explorer.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\csrss.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\dwm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1524
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\My Videos\Idle.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5904
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BijSvqZl13.bat"
        7⤵
        
        PID:5432
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:5452
        
        C:\Program Files (x86)\Common Files\explorer.exe
        
        "C:\Program Files (x86)\Common Files\explorer.exe"
        8⤵
        
        PID:6404
  - - C:\Users\Admin\AppData\Roaming\Windows\MpRunShellHost.exe
      "C:\Users\Admin\AppData\Roaming\Windows\MpRunShellHost.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5264
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vagfsvec\vagfsvec.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of SetWindowsHookEx
        
        PID:5632
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC7B5.tmp" "c:\Windows\System32\CSC7BA86940BA38418495C060624C129686.TMP"
        6⤵
        
        PID:5488
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\22bIrItv9P.bat"
        5⤵
        
        PID:5828
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5276
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:5408
      - C:\Recovery\WindowsRE\smartscreen.exe
        
        "C:\Recovery\WindowsRE\smartscreen.exe"
        6⤵
        
        PID:6472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "setups" /sc MINUTE /mo 12 /tr "'C:\Windows\ja-JP\setup.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "setup" /sc ONLOGON /tr "'C:\Windows\ja-JP\setup.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "setups" /sc MINUTE /mo 7 /tr "'C:\Windows\ja-JP\setup.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Windows\ja-JP\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\ja-JP\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Windows\ja-JP\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5860

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\smartscreen.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreen" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smartscreen.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smartscreen.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\msedge.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "setups" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\setup.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "setup" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\setup.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "setups" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\setup.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Install\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Common Files\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Common Files\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MpRunShellHostM" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Roaming\Windows\MpRunShellHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MpRunShellHost" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\Windows\MpRunShellHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5608

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MpRunShellHostM" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Roaming\Windows\MpRunShellHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5456

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Reference Assemblies\Microsoft\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Documents\My Videos\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Documents\My Videos\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\Public\Documents\My Videos\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5540

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:6928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3eb3833f769dd890afc295b977eab4b4

SHA1
e857649b037939602c72ad003e5d3698695f436f

SHA256
c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485

SHA512
c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
843402bd30bd238629acedf42a0dcb51

SHA1
050e6aa6f2c5b862c224e5852cdfb84db9a79bbc

SHA256
692f41363d887f712ab0862a8c317e4b62ba6a0294b238ea8c1ad4ac0fbcda7a

SHA512
977ec0f2943ad3adb9cff7e964d73f3dadc53283329248994f8c6246dfafbf2af3b25818c54f94cc73cd99f01888e84254d5435e28961db40bccbbf24e966167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
557df060b24d910f788843324c70707a

SHA1
e5d15be40f23484b3d9b77c19658adcb6e1da45c

SHA256
83cb7d7b4f4a9b084202fef8723df5c5b78f2af1a60e5a4c25a8ed407b5bf53b

SHA512
78df1a48eed7d2d297aa87b41540d64a94f5aa356b9fc5c97b32ab4d58a8bc3ba02ce829aed27d693f7ab01d31d5f2052c3ebf0129f27dd164416ea65edc911c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
58d99b8c0c6ed4bd5df3ed2b545847b9

SHA1
a5992442409bccd3f81e831e711a10adbb63965c

SHA256
8a102a89e9179b2c0b3e244ca83a0bafe31a9e031f124c5402277785acc29962

SHA512
e23b21fb865a546b2c19dc9b70f63e3499895435f03824ce7b452ffac28a700a0eb31b52868b313a013890ccbac7acd5b76a703472c99fe0ab9ea782983357f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
88a8001c5da61efa58f237decfb38660

SHA1
02700ffe923bf1eea5ff775e2955184484e3540a

SHA256
22d5aa903d3fe822e2c885886556076e356c63a429c5b90d4338c4d5fceafe12

SHA512
e2a58e2790f8a3cbf73e5352b5641a2b65d2ba9fd0beac479cfd36099f5030e11ad4ad249b9cc70773252364f72483333e35726b970ac8f439c54e2edfa060d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c71a1557ea40c5a77f38805aa6b6f4f5

SHA1
5f136e7a71e6abdd41845268b7b92ffd0302518a

SHA256
d2e90a2d8a9282658861690d669d75c26d5553e87ca02b7ab4e35924afcfc384

SHA512
137aaa6673f729d3ce101ffeaee7a88c437177fe29edde162373310a851da2ac540f3126b670487a4b055e8fdfa2b38d9643fd87189c8d6f8896e84aba15a440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b1c59e2f9f5516be99b8d88f0339727e

SHA1
19762da27da1fb9e5511e27146bf35b4949e9e5e

SHA256
7827e4be99a974d06ca3f969d0c4c727a4dd2a42e7aea3847d3706c4a4dd2edb

SHA512
159366c3104a7f0e4c99341557cbe3e71e2376b5ee1536ad3e4be690dc0fcc49e0611c170b5eb8d0e818cd480d685c9ea4a8bab9515af3ded247c56b55e7ec3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
952a6e3cbc50f011cf2f04c9470080ff

SHA1
a0d6a2509af73e523c970f6e4351861bde63d6db

SHA256
faa79ba7dfd140106187ab50f14aa7cca13650f94f796419bc0a44d7a2b79d5f

SHA512
7955092a6086f05268e4b0f88648d9275020b6cad83f81c90eac5a7cd994cc243b8dfab579d4335db62f3577fd2d8a7fbefcad6cc615e2bcf1d014115056cde4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
74d9eb5260fef5b115bec73a0af9ac54

SHA1
18862574f0044f4591a2c3cf156db8f237787acf

SHA256
7d7e7b38664d625a0bbffbcb7882b175709e92987bf9da113c4745fafbbc361d

SHA512
b85917201b1d4b4542a4424ce40ddd083ddbd0e230e1931fe6f7cdd2aa3d8a0eec8daa743ddc5467f0a92da5594144c602081d941b216ca9cafdfd3c150d32d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
161d4551287ba3746d439e463fafbe0e

SHA1
8241d22d09f345b94b1ec5476a1a8b34663726cf

SHA256
e3819521d83b066a9b43b437b5bb3368aaf2f80d3855ab16f49062d861a0ae52

SHA512
40e3c9308175f6723b78be8c9090f5f7f09c0da29e9546c2d20b85c5c38de2fe9e6095360eb78881af97cc29ff1af578d702da17c6a708a809793c046aa78e88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
730fb735b0e22da57ae78e8871357dcb

SHA1
d4a961e916c1783153777d316b9a2ed4269266f9

SHA256
6dcd5aa40ff89d7be6a91494f2d501f7574022c0873ea49e0c05b1863ee5788b

SHA512
739ce58bfbb0164f859f2d8f6327ef886cc39096413721ac803bd82f30a63ab42803bd09d75860fb3a7ec1a52ce23d84b2b9239394ba256dbbfc0f915e1db403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d6d1b8bb34838ccf42d5f69e919b1612

SHA1
20e9df1f5dd5908ce1b537d158961e0b1674949e

SHA256
8a4e7eae00df2e789c958a38e78ac0b53f439afe2d5bfe8a81fb8c6e232b6491

SHA512
ff3ba5dc3cb548018747a315f098e01c5a6f8aee029223ef4080b3db76b0ecaa6a01a1c79e1434bdf2aa5b2ae66ec85d33e760064282411c7712fba890a0309d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
259f92ca4969e252e3941605fc695b76

SHA1
25e5ccb6820e76e6d43051c1bbc5852974f3a909

SHA256
c9566654c22d290e28d0ab79da84712f58139bbf94340a9242eff1bb4ee952c0

SHA512
307a6a2a4941a94c02acb038cf1e8ec8882e664d748f0301c42d00d273f5ff77ab3a9b055f16c2a5b87291ea34e83344eb42984156bdcb1e6e050ba1061f1636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
38c9f99a1b1b5d651abad796bd6819cc

SHA1
6c87cc6ef29bb276d5568d67bb3913761f966e24

SHA256
6725081ef12c1bdac6c2436bf65d0e006e61039b09f93e7209fb3099b3ad4a97

SHA512
21cbee828cb9feb83415722aeb167e3d8a4992059b29b132581363640e06065cd688dc025cca97b3ee8ddf9289a182413acac0e5a9a06af0ad54e6848a3ae09f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f4a8935e5320e8517f33165dc73b5251

SHA1
8b715dacbc2ff93e6edd9e645bd5930cf34bd0cf

SHA256
c3c8e17224ed561bbc4783d70766920fbd608d97c9f7afdfa6336cde17921636

SHA512
5b08ec7551d22810e258900c3a2793b6cb9897960fa6966005938aeb06614b3514093788c53c28f6ec4c0da2cf1e33684ee1b29722bc8ba474dcbeeb2d01ca4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
470fbfe948aef3add3b3130b16438d11

SHA1
e0613f690d788cead2d7fcde2e4ce2d684c3831a

SHA256
bbc1b7fbf46f174d109d009fe8832164e9a0347c125b90cf79390b325bd7b12c

SHA512
830798c9e4f74bfeed04fc50621f2d65a00ee3afc05959b9f5169dc93e79c1906d0fbbd94d81adde7ad940a7a8f65137d0bf548ac5c14fdf2395b61af98b278d

Download Submit
C:\Users\Admin\AppData\Local\Temp\22bIrItv9P.bat

Filesize
213B

MD5
adc356487a80fa4c119f9ee321c356a2

SHA1
2ad873c02ec84babb7f8723511a7e74028224012

SHA256
2b7a080d4e9d948b58e54b20b378e866d3f7e4c156e1186d30f316176662c0bc

SHA512
21f95b260b4e9454a4de17eadd0f7f7a870cb46d85dbf8d3366d529edf9a488e4337568e0d9f207a5e207c15909155adf783547c309f30955362849d2bc194f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\BijSvqZl13.bat

Filesize
213B

MD5
18d5c15811b35d6e4294810f3449e0c4

SHA1
0c352df1eb5908196bef5c0b56b67812a4fdf9f2

SHA256
2f25104cc8ade6b3808c14da1e7e25dc451114b4b9e61849299ed838924722f7

SHA512
1d976b557e915ebda131fc2f722e1ead52b6d5232140344efbf3bccc76b4cd4f04debfa352f59ae8504fe35cb602c15dda0731945d93cf77cce8ab7c3365d065

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC7B5.tmp

Filesize
1KB

MD5
688bc9c81694c1d171a327be031dd40d

SHA1
d3e26bbfc7ea43faa0af699eb6494e8a8f7b1bea

SHA256
71ff289b5afefc7a167843c1dbaa468f1ff2ab85233cbb8bb1bb64bbe1b4c608

SHA512
29ec312dc094651c9a01b5852c6dc16d3a43e9eb1e6a63825eb6e0529d31b4453b95aab8c0fde8ce64a2f6fc72c76659042149f1c63e47efa431d0b75dfab65d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pafs4xr3.bdm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
64cbaba9e2348ea7ab3c4dafc191ab7a

SHA1
2eff822138a746b3378a554410011c0c94436cc5

SHA256
5be8e22d09f3ec3acc76e40a2a4f08e458a40cff1f627125293a2351c5a808c4

SHA512
abc5c126165fe53a5aed5eb7e086a22b218f0a0bb33644d58e6430a0024b602896565f8f3b55a3b172285d24d5223cac1a5824e384ce98045cb9ada0e354f0fb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
1d14e9ed1bf6e3b5ec3a181e5db1243c

SHA1
1ec80d30b1fe1e45ef7af6385ff3f4a55f76ada9

SHA256
0062857224f9ceb29e9ee84848618ea404987b5c413ee9eb59d0b9d3ea34d8b0

SHA512
3bbf7b9c55d673f86123c238ad0ebf5754a509a1f61de0a969358b375c34f3199462151a8e0df147becb7f7cf2e46b7f9acbaa4bb0a7632aad5b6020838048e9

Download Submit
C:\Users\Admin\AppData\Roaming\WinSFXConnectDevicesPlatform\WinHelper32.exe

Filesize
1.6MB

MD5
b1175c0088fbe6b210c43df7e44baaa8

SHA1
fbd090734f04b53171788a80624bbfab8a58e5f7

SHA256
611f4d944129bc531eadef510d5c1d96c7fa1f89c439928e64648bd2c7efd73d

SHA512
8b85a3a0bd38332b35a1025d6e2981a5925060a876f8ec970f2d4d31a95ecc4f2570331f5c2e2375c6a7df8383bf523c4eeecd80db1496763b9bdee94c69d4e0

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Mb2zA35gA0cosYEfu5j.vbe

Filesize
198B

MD5
7c458e78935f542736becd1ab2317f66

SHA1
88a78d7530fb84315ba9ec75edd21ceba6e36a0d

SHA256
6506454fb297c3d1856cf29cc2ae7a3b67412fed0bf8358ab974595b606373bf

SHA512
4bb0ee7898d23b907232788bcd366eef71df05b1b511a00bd8afc5019f80560dc2b7188d5f8852c641c749eea2d6227514d220f6bb5a47e8adf6f6bf540941c1

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\MpRunShellHost.exe

Filesize
426KB

MD5
2d94c0a9c700f4a1552a1e2fe2cd33e2

SHA1
7dfe6f390ea59bc8d53431cd3a4756c109e201ee

SHA256
352bb05902750f30bd3bc84600d65cad64eeae01c8e794ddb45a0d8453f691e9

SHA512
4add372efa87a762a63c528699b84ce3f0ad4f4f4966fb58a721d92a9d5e1f2acc49e8e406c89a25ba1698cb1ceb0714e9b63109ba3a26b24ee696096ce855f4

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\RunShell.exe

Filesize
1.4MB

MD5
a7794e4520ff83ec0fbda7574100c0bc

SHA1
862f3f52d938e4d611d7e5d5a925278318471e5a

SHA256
c3029d98e4eb3262a6443f8842f6b1e578e10a7342eb2b77ab338e7912b93105

SHA512
6a21448081aa4af539f217e665a1bd76bf3852e597e07ad45204acacb980569889668c3c24c7c97bd37f9c5a20f13bc0a65d1cff1482d46e0c4c763a05387d33

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\pzxvjMo.bat

Filesize
32B

MD5
e98d4bf64a7efde0dfcc3fa3f753e811

SHA1
0ec17d857cde6eb92541a978a934883a0df7db02

SHA256
43b8b0944ae8bbaaf36a20c56b04d5c8d9eea37b3ad5079b11f0e8c377803139

SHA512
35237b5dd0ef59982ce734b613105758591cb34b9f8ff6b50497b1da2d155d2bbc4ec9c269152d014732ba4aca16e0ea52bb0248df5c164a83b72a549eb942dd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 796371.crdownload

Filesize
2.4MB

MD5
ba6c31647c5a5eccf9b535dd59e5069f

SHA1
445cfd5725f22c286c6ab6b950559e240528e4dd

SHA256
500160c555f21bc39acc78ab1379f5156cf89abf02d0f6b66cfc3d809ae98f5b

SHA512
a1cf93a3732467eb41961567af8a9778e6cd72e1f5b1219c7a7e34b88e2fa31b04e7b4cb1fd89fc166b507b558c25a1d3511cf19b3fa901a7eeda87263bc93f2

Download Submit
C:\windows\system32\fgih3v.exe

Filesize
4KB

MD5
7ddb39ac55104ffdd1689bb068787765

SHA1
07cf9c1fea0b491a52a76abc7aa441d2f2f24948

SHA256
f7dfabd6dbdea867e0be62406c2a67ae0ec2826e0beae5a2c4c12c3665e625e7

SHA512
059fcbd0ba233f94dfe66fb09e9f90ed2dfe12707a00190a00f95088b2022db74cf971439c9c53eccbcb0a56d13bb8f61cbc3502b2fed5a748343f2f272bec21

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vagfsvec\vagfsvec.0.cs

Filesize
358B

MD5
ec7fe76f8f381f443b66849b761c665e

SHA1
1f020dddcd619cdd7ffb9eb0bebe098020b0d91a

SHA256
181cf302af66a48de5201f1cbfcc926be9b96426646c21f2c2c484096cad02dc

SHA512
f626b354bba369a992a279c3dc791c29bb59059dfda93c91f7786ec98f6ae3b313327e11ba17ce5a47d73fe2e2f03934a5b4c0ee1d995d3dcb7d9a962c8c8b3f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vagfsvec\vagfsvec.cmdline

Filesize
235B

MD5
10ae92284c8fb927be6a46157c964393

SHA1
4cd4084394a7d3b53113ac5573446545dafd249a

SHA256
910823d51a689dadd26e73f6a02dd6fdca0e9851f49be7c58d0095338e5bfc64

SHA512
ee6899fbf0e71edfdd8d1dfbc0f6f6b2421c0323e1f31f0800306bd83ddd5412cef901a2fdf2bc08b30c32c3087a44f4dc4aacf32b0b365e32cffa29d0e80c0f

Download Submit
\??\c:\Windows\System32\CSC7BA86940BA38418495C060624C129686.TMP

Filesize
1KB

MD5
727c38fa55811628c8316db356fb7b60

SHA1
902eb81ba9ba6c3d28368d25d38b556f70e97b1f

SHA256
742f65de0ab733a9148e81423489f33d2c18808f8cf70c9965b80aaa80a782c5

SHA512
7486b3cbb160f1365085d29a9974558996f149fcc26c97ba91d1bf5ce967ae4fd871860fc4c17d9ba8325c807771559d90f4cc34f8d5e265ebf3ad25323225c5

Download Submit
\??\pipe\LOCAL\crashpad_4304_OGDQLGUEMHWLBTUW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2252-330-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5192-273-0x0000026E97930000-0x0000026E97931000-memory.dmp

Filesize
4KB

Download
memory/5192-202-0x0000026E97930000-0x0000026E97931000-memory.dmp

Filesize
4KB

Download
memory/5192-290-0x0000026E97930000-0x0000026E97931000-memory.dmp

Filesize
4KB

Download
memory/5192-326-0x0000026E97930000-0x0000026E97931000-memory.dmp

Filesize
4KB

Download
memory/5192-276-0x0000026E97930000-0x0000026E97931000-memory.dmp

Filesize
4KB

Download
memory/5264-337-0x0000000002FC0000-0x0000000002FD8000-memory.dmp

Filesize
96KB

Download
memory/5264-341-0x0000000002E60000-0x0000000002E6C000-memory.dmp

Filesize
48KB

Download
memory/5264-328-0x0000000000C10000-0x0000000000C18000-memory.dmp

Filesize
32KB

Download
memory/5264-329-0x00000000012A0000-0x0000000001372000-memory.dmp

Filesize
840KB

Download
memory/5264-332-0x0000000002E40000-0x0000000002E4E000-memory.dmp

Filesize
56KB

Download
memory/5264-334-0x0000000002FA0000-0x0000000002FBC000-memory.dmp

Filesize
112KB

Download
memory/5264-335-0x0000000003010000-0x0000000003060000-memory.dmp

Filesize
320KB

Download
memory/5264-339-0x0000000002E50000-0x0000000002E5E000-memory.dmp

Filesize
56KB

Download
memory/5352-233-0x000002BDF2220000-0x000002BDF2242000-memory.dmp

Filesize
136KB

Download
memory/5516-369-0x000000001AF80000-0x000000001AF8C000-memory.dmp

Filesize
48KB

Download
memory/5516-371-0x000000001B000000-0x000000001B00C000-memory.dmp

Filesize
48KB

Download
memory/5516-364-0x00000000002D0000-0x0000000000436000-memory.dmp

Filesize
1.4MB

Download
memory/5516-370-0x000000001AFE0000-0x000000001AFEE000-memory.dmp

Filesize
56KB

Download
memory/5516-365-0x0000000000B00000-0x0000000000B1C000-memory.dmp

Filesize
112KB

Download
memory/5516-367-0x000000001AF50000-0x000000001AF66000-memory.dmp

Filesize
88KB

Download
memory/5516-366-0x000000001AF40000-0x000000001AF48000-memory.dmp

Filesize
32KB

Download
memory/5516-368-0x000000001AF70000-0x000000001AF80000-memory.dmp

Filesize
64KB

Download
memory/6472-492-0x000000001B830000-0x000000001B902000-memory.dmp

Filesize
840KB

Download
memory/6928-511-0x00000209984C0000-0x00000209984C1000-memory.dmp

Filesize
4KB

Download
memory/6928-523-0x00000209984C0000-0x00000209984C1000-memory.dmp

Filesize
4KB

Download
memory/6928-522-0x00000209984C0000-0x00000209984C1000-memory.dmp

Filesize
4KB

Download
memory/6928-521-0x00000209984C0000-0x00000209984C1000-memory.dmp

Filesize
4KB

Download
memory/6928-520-0x00000209984C0000-0x00000209984C1000-memory.dmp

Filesize
4KB

Download
memory/6928-519-0x00000209984C0000-0x00000209984C1000-memory.dmp

Filesize
4KB

Download
memory/6928-518-0x00000209984C0000-0x00000209984C1000-memory.dmp

Filesize
4KB

Download
memory/6928-517-0x00000209984C0000-0x00000209984C1000-memory.dmp

Filesize
4KB

Download
memory/6928-512-0x00000209984C0000-0x00000209984C1000-memory.dmp

Filesize
4KB

Download
memory/6928-513-0x00000209984C0000-0x00000209984C1000-memory.dmp

Filesize
4KB

Download