hxxps://drive[.]google[.]com/file/d/180sehI7QLPwN24iwSW8axri2-IwLaebK/view

Analysis

max time kernel
129s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
16-11-2024 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/180sehI7QLPwN24iwSW8axri2-IwLaebK/view

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
684	powershell.exe
3044	powershell.exe
4004	powershell.exe
640	powershell.exe
3048	powershell.exe
2104	powershell.exe
1288	powershell.exe

Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
5032	7z2408-x64.exe
1176	7zG.exe
2236	center.exe

Loads dropped DLL 1 IoCs

pid	Process
1176	7zG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
1	drive.google.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2408-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2408-x64.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	expand.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier	msedge.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
5116	mshta.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2408-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	center.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2408-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2408-x64.exe

NTFS ADS 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\KMS_Suite_v10.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 793100.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4484	msedge.exe
4484	msedge.exe
3312	identity_helper.exe
3312	identity_helper.exe
3620	msedge.exe
3620	msedge.exe
3720	msedge.exe
3720	msedge.exe
1884	msedge.exe
1884	msedge.exe
684	powershell.exe
684	powershell.exe
684	powershell.exe
3044	powershell.exe
3044	powershell.exe
3044	powershell.exe
4004	powershell.exe
4004	powershell.exe
4004	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
2104	powershell.exe
2104	powershell.exe
2104	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4320	powershell.exe
4320	powershell.exe
4320	powershell.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
3536	msedge.exe
1288	powershell.exe
1288	powershell.exe
1288	powershell.exe
640	powershell.exe
640	powershell.exe
640	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeRestorePrivilege	1176	7zG.exe
Token: 35	1176	7zG.exe
Token: SeSecurityPrivilege	1176	7zG.exe
Token: SeSecurityPrivilege	1176	7zG.exe
Token: SeDebugPrivilege	684	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	4004	powershell.exe
Token: SeDebugPrivilege	3048	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	4320	powershell.exe
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	640	powershell.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
1176	7zG.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5032	7z2408-x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 716	4484	msedge.exe	77
PID 4484 wrote to memory of 716	4484	msedge.exe	77
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 3572	4484	msedge.exe	78
PID 4484 wrote to memory of 4676	4484	msedge.exe	79
PID 4484 wrote to memory of 4676	4484	msedge.exe	79
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80
PID 4484 wrote to memory of 556	4484	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/file/d/180sehI7QLPwN24iwSW8axri2-IwLaebK/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffddaba3cb8,0x7ffddaba3cc8,0x7ffddaba3cd8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1644 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1792 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1884
- C:\Users\Admin\Downloads\7z2408-x64.exe
  "C:\Users\Admin\Downloads\7z2408-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,4387272508352121439,11514592956986954482,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1196 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1728

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2852

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\KMS_Suite_v10\" -spe -an -ai#7zMap17859:88:7zEvent9672
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\KMS_Suite_v10\KMS_Suite_v10_EN\KMS_Suite.v10.EN.bat" "
1⤵
PID:5060
- C:\Windows\system32\mode.com
  mode con cols=78 lines=5
  2⤵
  PID:724
- C:\Windows\system32\mshta.exe
  mshta vbscript:CreateObject("Shell.Application").ShellExecute("cmd.exe","/c C:\Users\Admin\DOWNLO~1\KMS_SU~1\KMS_SU~2\KMS_SU~1.BAT ::","","runas",1)(window.close)
  2⤵
  - Access Token Manipulation: Create Process with Token
  PID:5116
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\DOWNLO~1\KMS_SU~1\KMS_SU~2\KMS_SU~1.BAT ::
    3⤵
    PID:920
  - - C:\Windows\system32\mode.com
      mode con cols=78 lines=5
      4⤵
      PID:1856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:4948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\KMS_Suite"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\DOWNLO~1\KMS_SU~1\KMS_SU~2\KMS_SU~1.BAT"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -c $f=[IO.File]::ReadAllText($env:0)-split':KMS_Suite\:.*';iex($f[1]); X(1)
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4004
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\krquh0lm\krquh0lm.cmdline"
        5⤵
        
        PID:2064
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES36A6.tmp" "c:\Users\Admin\AppData\Local\Temp\krquh0lm\CSCF20E87D1FD34631964E8FBCE9F64AA3.TMP"
        6⤵
        
        PID:4792
    - - C:\Windows\system32\expand.exe
        
        "C:\Windows\system32\expand.exe" -R 1 -F:* .
        5⤵
        Drops file in Windows directory
        
        PID:1168
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c KMS_Suite\KMS_Suite.bat -suite
      4⤵
      PID:3288
    - - C:\Windows\system32\mode.com
        
        mode con cols=78 lines=6
        5⤵
        
        PID:3420
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        Powershell.exe -executionpolicy remotesigned -File disablex.ps1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rw5pvwow\rw5pvwow.cmdline"
        6⤵
        
        PID:4448
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3AFC.tmp" "c:\Users\Admin\AppData\Local\Temp\rw5pvwow\CSC65194D0A765A408BBBD5FF94DE5EC49.TMP"
        7⤵
        
        PID:3076
    - - C:\Windows\system32\mode.com
        
        mode con: cols=90 lines=40
        5⤵
        
        PID:1588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -noprofile "$W=(get-host).ui.rawui; $B=$W.buffersize; $B.height=90; $W.buffersize=$B"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"
        5⤵
        
        PID:924
    - - C:\Windows\system32\mode.com
        
        mode con cols=92 lines=35
        5⤵
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\KMS_Suite\bin\center.exe
        
        center.exe kF5nJ4D92hfOpc8
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2236
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"
        5⤵
        
        PID:2360
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ver
        5⤵
        
        PID:3720
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
        5⤵
        
        PID:4780
      - C:\Windows\system32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
        6⤵
        
        PID:2668
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -nop -c "(([WMISEARCHER]'Select Caption from Win32_OperatingSystem').Get()).Caption"
        5⤵
        
        PID:4368
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nop -c "(([WMISEARCHER]'Select Caption from Win32_OperatingSystem').Get()).Caption"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4852
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -nop -c "(([WMISEARCHER]'Select Version from Win32_OperatingSystem').Get()).Version"
        5⤵
        
        PID:1548
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nop -c "(([WMISEARCHER]'Select Version from Win32_OperatingSystem').Get()).Version"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4320
    - - C:\Windows\system32\mode.com
        
        mode con cols=92 lines=35
        5⤵
        
        PID:2244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c time /t
        5⤵
        
        PID:2196
    - - C:\Windows\system32\findstr.exe
        
        findstr /v /a:78 /R "^$" " KMS & KMS 2038 & Digital & Online Activation Suite v10 - mephistooo2 - www.TNCTR.com" nul
        5⤵
        
        PID:1044
    - - C:\Windows\system32\findstr.exe
        
        findstr /v /a:6 /R "^$" " SUPPORTED MICROSOFT PRODUCTS" nul
        5⤵
        
        PID:1588
    - - C:\Windows\system32\findstr.exe
        
        findstr /v /a:6 /R "^$" " [1] ACTIVATION START FOR WINDOWS & OFFICE (KMS Inject Method)" nul
        5⤵
        
        PID:4560
    - - C:\Windows\system32\findstr.exe
        
        findstr /v /a:9 /R "^$" " [2] ACTIVATION START FOR WINDOWS 10-11 (Digital & KMS 2038 Activation Method)" nul
        5⤵
        
        PID:3336
    - - C:\Windows\system32\findstr.exe
        
        findstr /v /a:2 /R "^$" " [3] ACTIVATION START FOR WINDOWS & OFFICE (Online Activation Method)" nul
        5⤵
        
        PID:3488
    - - C:\Windows\system32\findstr.exe
        
        findstr /v /a:7 /R "^$" " [4] WINDOWS & OFFICE ACTIVATION STATUS CHECK" nul
        5⤵
        
        PID:1456
    - - C:\Windows\system32\findstr.exe
        
        findstr /v /a:3 /R "^$" " [5] KMS & KMS 2038 & DIGITAL & ONLINE ACTIVATION VISIT WEBSITE" nul
        5⤵
        
        PID:3044
    - - C:\Windows\system32\findstr.exe
        
        findstr /v /a:4 /R "^$" " [6] EXIT" nul
        5⤵
        
        PID:2924
    - - C:\Windows\system32\choice.exe
        
        choice /C:123456 /N /M "YOUR CHOICE :"
        5⤵
        
        PID:1748
    - - C:\Windows\system32\mode.com
        
        mode con cols=58 lines=6
        5⤵
        
        PID:4780
    - - C:\Windows\system32\mshta.exe
        
        mshta vbscript:Execute("CreateObject(""WScript.Shell"").Popup ""SPECIAL THANKS : TNCTR Family - NSANE Family - CODYQX4, abbodi1406, qewlpal, cynecx, qad, Mouri_Naruto (MDL), WindowsAddict, mspaintmsi, BAU (AveYo)"", 4, "" .:: mephistooo2 | TNCTR ::."", 64: close")
        5⤵
        
        PID:3164
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ver
        5⤵
        
        PID:5016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Remove-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\KMS_Suite"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1288
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ver
      4⤵
      PID:2576
  - - C:\Windows\system32\mode.com
      mode con cols=60 lines=1
      4⤵
      PID:2216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Remove-MpPreference -ExclusionPath "C:\Users\Admin\DOWNLO~1\KMS_SU~1\KMS_SU~2\KMS_SU~1.BAT"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
1143c4905bba16d8cc02c6ba8f37f365

SHA1
db38ac221275acd087cf87ebad393ef7f6e04656

SHA256
e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812

SHA512
b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
692KB

MD5
4159ff3f09b72e504e25a5f3c7ed3a5b

SHA1
b79ab2c83803e1d6da1dcd902f41e45d6cd26346

SHA256
0163ec83208b4902a2846de998a915de1b9e72aba33d98d5c8a14a8fbf0f6101

SHA512
48f54f0ab96be620db392b4c459a49a0fa8fbe95b1c1b7df932de565cf5f77adfaae98ef1e5998f326172b5ae4ffa9896aeac0f7b98568fcde6f7b1480df4e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ec51b3fe17fb8fadc4a156ca2ad081db

SHA1
244df674ddaadf999bc426c60cf45d2ebb7bd9b7

SHA256
0e6e52e59830c5464327e979157eb48b2011df7fc6c53f76a87a13f147dcb454

SHA512
991bb063de7f20d356e56333a89d067c40e8323ce83b41502fbfb7666b1eb635996809e14d5f9663fda888cc2e468313e2b40fdffc1a5ef0d9b460b7440a818b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
c8b6f6cae61d9cbfecb0619d4b5e223c

SHA1
6254df4a018b794798eba22fce4a43787be740d3

SHA256
d9123949fe33c74d30c998d9692f5bc02c6c0a21cad0b78a9a594c9cf05347e2

SHA512
62ce3376451f6d748a4feeb267543ca981602cf479a4ade40c988709d2a91df2c18e324c2944fc5eeb5afa9245db202085fd4d934bc86325e8ac4b5925192ff5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
4a5c18a290b12bc798ddf599893516cc

SHA1
30db2c01eb1136a8b95fa68ab6fcec43bc8b3d44

SHA256
1a13670e89005052c55c738b6a80ec27c0fdab09011b3c0e73115b9c6f1a7459

SHA512
bc32e964e1624b68f7c1a21fd499b5cd1a1de495f725dd25fe7e13cdac3728365473c79a3d102c2082f7814f04d7f7423cf318fa037527be7664b9bda22f453e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
14ab0ded1cd85a50ae977ebaba97cdca

SHA1
afc625e607aefb35af3b56353e6a633b933c4fa2

SHA256
983c12b59b8264da69eb1f95d8c94da5282ce38e4e3332a3d627738b953d7da5

SHA512
acf7235a914ffc6aad467ac49b4f54717aa816763c16d4608e5297e89132ff95904eef3eaadd5e06d96d64f1c03fc4fdebcfda81f4e0918773ec6fad5f77786c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a6c3ddd3dbe33ece1571b0572353acc

SHA1
b58df021b17f31cfbe64c5cbea43195b060a018b

SHA256
2243c1554a66554af90a296b9c70a88db294edb6cacca86ff3ca0d3d7f83ad79

SHA512
1bae820b82af85112cb38f9e864ecb495a5ef32f15a9d0cc7ba2d8051118115392d25663bad405dd49d16696b07bc8bbe0e890318aa43af3fed6ffc68ba435ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd4b1aa8065d38f1542328979b82ef88

SHA1
d10887ecaa292f19bc77739b64cddce00de0e820

SHA256
662dc7804a45f4cc0a65d2a2b447571cf7fb422bb98bf0194c3201f4ad08d053

SHA512
ee24ddb84a579743fefdbbc1466a6ac2d2dd8ddff61621837194072a4f8e74c1a6a502ce3d00ce03663b062adc7049d50b4e9d046e80d881e9eb0a9a73f842cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b90b5372f6d2cc87275149fd30ef1f5a

SHA1
c4a61eda5cb0ee971103e51cff1f1f93854fc937

SHA256
88016d96b2ce2e6ac171b8bed935e680a717b8f7dd4f9fdde88ae3d64b77a5de

SHA512
4e35cab48a7ed447025bcb0298ddfb59fad7ff258f70453bc1585ea36bc90bb682f8e5ca6a359966c2abff223dc71c3259fbc52be3d6e6836c3a9add1d9e2533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
667cb0c88e1052611ae79ae340f42702

SHA1
f5a855e2a5acf0ad1e86556801f88475ceba8ebd

SHA256
9180d544dfdc1f538429c9a45aba4c782dab0d4d4c1dbd87120ea029bbbe3a2a

SHA512
61a9f7cdd91c703d0b8988b1959e26427a6dd878ab6cdbb5b1fa5ae34133bd9bb701d02e7c845ab39aac2226a60ac3b80d0f247d4573003f0c1ff71082539f09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583c49.TMP

Filesize
1KB

MD5
d10d6b67c290543d8afc2d2d87b48adf

SHA1
3225a39d8edad53a35654ed116cfe06ef8d54e4f

SHA256
6dfcadc7b3928fed79eff87986b1f40dbb8c26cb45fd2e6ff45e83b5ccd2c56b

SHA512
211dce954853f8f8dcd6816b2df99511541218fc2554868a4229c63bbfb11b585bf06da7d37dd2a7687b73fa2805b6cae222aa22555974451f73ceddf94f84ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
60959229296b585079d71b51b0380af3

SHA1
f0de36d20e04b115859179e627a1ce6e06559875

SHA256
1c7be9e5ba0e64ed6ae44bc4b62029d7452c567747c3f9c5ca850c1a77b71998

SHA512
324230fc37b991045fe83c0149ab991fbef17892b9a15873788d2a7a44c3647b3e49be6fb6ee3997898ae57d3c3b0fb524d72a9d0261984b217f03c704e97cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fca3e33cd532555d731e44188d931ca7

SHA1
545f9d3f64aacf1e7b190efd3db3e2140c326141

SHA256
957660f2780826f08534cfaa6c497cf9b84dc06e6178b25748b930fd33f680bf

SHA512
ec2ac87327913875733657169320ef255b664fb16a340ed1f38c6d81345ea34199865aee0096e26fb2e0775fe245600a27462ff492ca0d1fb3eb5709ab9e2bff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
353b3f9e0debac179ab2456eb5fdb405

SHA1
d2622455ff6ea1b1296936fe5df5789c42c71790

SHA256
11c941d14466d77da700611e23161ff61205735bf5cd74e7f73aaa04b9048c12

SHA512
d774233f62d26902fa63dbc073dfdbe9788f591d407813ff0c2c912071eefd87949afb958580c19db08b284c70f183f5224ef93a72de333f4c79207431ff3d60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
cef328ddb1ee8916e7a658919323edd8

SHA1
a676234d426917535e174f85eabe4ef8b88256a5

SHA256
a1b5b7ada8ebc910f20f91ada3991d3321104e9da598c958b1edac9f9aca0e90

SHA512
747400c20ca5b5fd1b54bc24e75e6a78f15af61df263be932d2ee7b2f34731c2de8ce03b2706954fb098c1ac36f0b761cf37e418738fa91f2a8ea78572f545cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7492909f1e7a68860082985d9a1823dd

SHA1
27097b2fb17577f3653dace831218703f767d89b

SHA256
69e1beb753e36745b4159267f390148ad73b79d7d8536bfa842274e04d3360a9

SHA512
2378fa72ebabcaa436d6467a3964f39c790105c09d8e52e37aa089899f1dacb8a5d7266a25e33283e2065ab73873119fd14762b1910d26fe2685aa5f0beee405

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7cbe2604ded294ac1f99eddf6c0bb5d2

SHA1
5da09124dc8fe3ceb36bd1c8a2adfc9f04171095

SHA256
36b596d4bccd0c1974d078f9f03a8d1dbea7366bd1574b9126a17200375a94c8

SHA512
0fb1c35fb739ea7db7fae325b9c1ee30d4245a2e5deeb77cb89756ab5a4d326c4158f9181afcb46692d694183877e8d5cc96fd45b6b806b0e55b735653b57215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f902d0c54a7c812def6501474b58b46f

SHA1
81edd884dbda083970da1b81a6b8e7dff0e8c119

SHA256
e83f3b05eff53b90153e381f1305a8a02aad3441733e266dfd445cf44c79bfeb

SHA512
958d01f9033f3d06c21a8e14fde5bfeeb239aadb72f1ff3e2ac9d054f47c70f92a20e5e58843b8e7da26a2a5ac5c1b437bce43b7924cc8b3485bc5c1d2a6639d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ KMS & KMS 2038 & Digital & Online Activation Suite v10 - mephistooo2 - www.TNCTR.com

Filesize
3B

MD5
df66fa563a2fafdb93cc559deb0a38c4

SHA1
e6666cf8574b0f7a9ae5bccee572f965c2aec9cb

SHA256
3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351

SHA512
34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18

Download Submit
C:\Users\Admin\AppData\Local\Temp\1

Filesize
892KB

MD5
5abbc580c5e649944b1223855718f7ea

SHA1
589b61a42d106c88752a94c2dac7d6e29f73d8d7

SHA256
2fdb035adff530cbf17ab9d6a4ae9e539b9bf0bf78953be2b9d337da5ea019ec

SHA512
f4108e5bd4a5423a66565dac5cc0eb054ab894b9347218d0b225cc605525bbbb429ecfe777b08179cb988a1008430b8d1b9bf233c268939e07ee99edc8ff1ac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMS_Suite\KMS_Suite.bat

Filesize
154KB

MD5
155a9e2d2f638159569c2995f34b71d0

SHA1
2676c864524bcef07e1381d194e3f7cd6a6ea439

SHA256
718e0127a009a5213523718a259722a461a2791ad4b3ef5b122c8db92954fd85

SHA512
2b5e9c7714ea10edcf68aa85d9c2108e709160e23e2b21abdc716360dece26d2c26141e417160d1f1a1bf7bef9fe783a822155761b97f93418c1a7eb6a16d8ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMS_Suite\bin\center.exe

Filesize
72KB

MD5
0a847eafddc4529388e1a1b291354cf8

SHA1
adddd1b79c64c7c1d0d440df847be31ee94e664d

SHA256
69533d9b66b840b4764f901cd6a502d12453b604617a841f4c2c602fc87df255

SHA512
7b3ddb5be55367fc5fcfaa99f9a3b7f0888234c82146f3af6b012ff1feacf8b087cf53cce3e57492417a8e88657a045d948fedc07645e5a018604c158bd15710

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMS_Suite\bin\disablex.ps1

Filesize
1KB

MD5
522c0e01b280581a62954cf1e7971eaa

SHA1
4b8a66cd6839d05a3bd2732124a4441797940075

SHA256
2d2e271131e130688218b369cada1444807a0a65120df942a98e7887bdfe7201

SHA512
c9299b176f3279f1f37a9744d6361009daafe815a8e8b96e3d9dd0865ef9f938e3c33773fde3dac93f5d3cebc6b1d2952c02e0816a9b0ca5c8d0c6f19f3f1950

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES36A6.tmp

Filesize
1KB

MD5
92b6f94ea0b94ddde0e79c6e12dda99f

SHA1
8fc46f558735fc9dd9103e9737309046dfb2c80d

SHA256
e9d9f6a94e50fd8274df2abdabaa9a604bbe852e7d8c8165115d9c4dd552e0d7

SHA512
0774cd7d62e555d1ae7aa0feb6af1e0fce328bc2ecdda2ce743dfb24ff49a9c4b90c3cbcea4cf75f90eba3c43e20eb6cb3cb17a3ebec9d6c07224f6f2c435986

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3AFC.tmp

Filesize
1KB

MD5
290ea0a181286526870e94844cf6071c

SHA1
92ec869f36d842232a4bc2ca5180b0069331faa2

SHA256
060992ce203598e384118efdf0191790a16d73bbc8b223b2d48285979ba951d5

SHA512
8aa2c0d49eb3c3a86496c28de50316988741ed0ba166b7b7272f3ac152e379dfe491a561a29d07c5391bc15044f704ac6ba581b24caafe705ecc0187203122c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0sjczr03.pcg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
92B

MD5
e327bf9fba535a2009fb940d46eaf87a

SHA1
5413c774f5e2983c25baa1bcc021e8828bc9c361

SHA256
00a431fd45c8e370125dbcbb314f2b2d6f0d2e015957fb72a9cf16cc52f6e300

SHA512
c9f12163dd6ed7d9310f5973cd575031f02adfb3b87f088718386d5e232dfa020ba9eb4eb12e2d91337f02cb1cef0a92a30f09565e3ef3be50b1a07958914562

Download Submit
C:\Users\Admin\AppData\Local\Temp\krquh0lm\krquh0lm.dll

Filesize
3KB

MD5
5e979e7a96a190aa095fef2651d1b855

SHA1
a99b56d318bea42a894b1c81164ed26e0cbc8cc3

SHA256
c8c15648961c155191cee5aeac88f6d602c44aa74dda9ac513f857d715926331

SHA512
46b665279dbc114dba0cdf6d09c7f11f737c8b39ab8c564979af0926537387559630840bb2c59fcbe890f6488134f40c5bcfc4cf62d1516292c63989c616df9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\rw5pvwow\rw5pvwow.dll

Filesize
3KB

MD5
13eddb595592bbe23df207dfb6cd0254

SHA1
dbbd5883ddd63b7d8c081246e57dae4bc1299983

SHA256
7f6e067ca472dc8d593c05a93a8d8c5b256732f8ca84e818e068c0f67de91749

SHA512
251264b0fc1f2f9e70603d6c7535048bbcabe57b864fa544d31799be212cb2be1a5f8dda59136a0ccce56a36f457222a8695668d8f9f710beddd36794991a8a9

Download Submit
C:\Users\Admin\Downloads\7z2408-x64.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\KMS_Suite_v10.zip:Zone.Identifier

Filesize
186B

MD5
ca4d4e1a29cdcd3b3d9a513495143dde

SHA1
a8db389ee069200c0a569f1debd5f94c02846e21

SHA256
2aab7c379719c5ccb4271775cb99fca3d6400a4957a238cbc1ffa0a5a9d03344

SHA512
b99746b271b120af262e2003b2f45de3c33423878232db4947351591fed5a4b268c31fbff299edf911c1b90d53cd0c6ffae1170027bce0d68a70623fc8a64d16

Download Submit
C:\Users\Admin\Downloads\KMS_Suite_v10\KMS_Suite_v10_EN\KMS_Suite.v10.EN.bat

Filesize
1.1MB

MD5
d5820c4b05d401d06fe502cb0f3a42b3

SHA1
a984c53db0145bec0ac80a4d5d016a8543c7e380

SHA256
5fb6aa600795ed710a733496c8ec48c57b2076f042a707beb56438cb52c13066

SHA512
85f2e34d43d6e79cbf7403bbf7b94046a91115ceef9b3f2e32da680880a20eee165cdc891ab0d7a8ac1209a4cd3f94490c2ec76ebfa0e6942022666b644d4ede

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 278742.crdownload

Filesize
1.8MB

MD5
0e4fbec1886124102efefeed0250455f

SHA1
99f4571f653cbf1f7843fdcf8b365e44996be7d1

SHA256
53e6179cf7c1190bb265015f176dc49eff482ed33cd9dd2812c4fe73ac582923

SHA512
f50ff85c8fda5e0bd5531588af690bbca92641279a6086058798aa98bb2c5db98d5e705e6a951440b0c55f8d4f0eb5f33ec2dec82d753f775a597e32a69c8f77

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 793100.crdownload

Filesize
1.5MB

MD5
0330d0bd7341a9afe5b6d161b1ff4aa1

SHA1
86918e72f2e43c9c664c246e62b41452d662fbf3

SHA256
67cb9d3452c9dd974b04f4a5fd842dbcba8184f2344ff72e3662d7cdb68b099b

SHA512
850382414d9d33eab134f8bd89dc99759f8d0459b7ad48bd9588405a3705aeb2cd727898529e3f71d9776a42e141c717e844e0b5c358818bbeac01d096907ad1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\krquh0lm\CSCF20E87D1FD34631964E8FBCE9F64AA3.TMP

Filesize
652B

MD5
6d050e8e5f97977a682e2e48d84fc329

SHA1
ecd7843b813fd2a3a6472239c7f8788c113917b3

SHA256
66f03771c7b084268b537b9c3410bbadc86897d1a9c1fa87454a7a44edfe928c

SHA512
11e127eb36b0e896c6ac14a0890e82bdcd1ecd44eeeac9610a05308372cd483440ccb45d6b71a414aa9d7b74b3c957cb5bed8cb665f4c3c574979660588b441a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\krquh0lm\krquh0lm.0.cs

Filesize
521B

MD5
047f0cf592670e8fca358f12e4cd5a89

SHA1
0cd8cdde668e7e64adb49e388e75e1136429e5f6

SHA256
32e77d9085ad9ea0fd1eb5a9556e29cb42f5d3016ccf9853f3c39d358f479978

SHA512
368b22e424520c272195d3264123fceb2dba549574ff7282c210ffb6d9e8f574b7392f199304f2adef974d4d926fbccb1ce50fbd8ad4e89f05cec58635357cc8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\krquh0lm\krquh0lm.cmdline

Filesize
369B

MD5
5574914566de0d13af7d053b217ee034

SHA1
e5692d68682876ede681ae76bc205f09f57b3c8e

SHA256
21623305c196ca6d207eadd1d61f25bab52268d086eb0bc64abb406938eb55a6

SHA512
1f23e76fb444e5a1eb2038177d778bffe3cf50f76bdb3dbfc4c2d12544afb801121ac81fded355c6be6b1d26fb43a0f4b348652cc8ff378018984aeb66d35d3a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rw5pvwow\CSC65194D0A765A408BBBD5FF94DE5EC49.TMP

Filesize
652B

MD5
42160d5c12eb3ac30cbe41b56378cccc

SHA1
e5534c2adf53ca07e9932273957c8d86eb0ca4a8

SHA256
2ea9544ded4a7b4b666b409ddb4bc46ed36b08864f52fcb40264ea14e8e2f640

SHA512
56134026b1fbe484cb4f50337c203a78d30f75038c6386e29bb51e67daa647293db9c6d87bf7fb6eb31b8ca5996d59af67f480587b72e5aa967a795729b686aa

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rw5pvwow\rw5pvwow.0.cs

Filesize
1KB

MD5
810a30d3e12a7bb7b78a5ec70fec88ee

SHA1
921dc2985f892a800c2bb00e9166d232e78accf4

SHA256
86a49c1dfe76226db0daa8be63437e41d76c379f6c8a80d77930b771a6780487

SHA512
6792ef5c81b717b90f2bd211973d52be6ff2677915e76c2bb21b44610b5803852bac0d90df32faf9a50636c67ebc516abf3a2ca4a37ceb411133527740d5543a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\rw5pvwow\rw5pvwow.cmdline

Filesize
369B

MD5
fd6798ac45c045ff22cb6f3466447673

SHA1
44a30727b2d4e111ca510348d3c1fac9080bc9f4

SHA256
29d61b97be4486b91503ae4e92670f3d2d342e869433c8dd85fc292a09823f9a

SHA512
9f442884ba4673b3751a58f929c91611099043a8cdd313a779040da24296f20cc3b41c445d761a2b684b5c12c22fc3a78cc1e3adb8ee0b98e188b2f889ef0b17

Download Submit
memory/684-587-0x000002CE29C80000-0x000002CE29CA2000-memory.dmp

Filesize
136KB

Download
memory/2064-629-0x000001C01EEC0000-0x000001C01F982000-memory.dmp

Filesize
10.8MB

Download
memory/3048-697-0x0000024713820000-0x0000024713828000-memory.dmp

Filesize
32KB

Download
memory/4004-631-0x00000224606E0000-0x00000224606E8000-memory.dmp

Filesize
32KB

Download
memory/4448-695-0x000002D05B620000-0x000002D05C0E2000-memory.dmp

Filesize
10.8MB

Download