Malware Analysis Report

2025-01-18 16:15

Sample ID 241214-f44nwatncx
Target http://wearedevs.net
Tags
crimsonrat darkcomet discovery evasion persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file http://wearedevs.net was found to be: Known bad.

Malicious Activity Summary

crimsonrat darkcomet discovery evasion persistence rat trojan

Darkcomet family

Process spawned unexpected child process

CrimsonRat

CrimsonRAT main payload

Darkcomet

Crimsonrat family

Modifies WinLogon for persistence

Sets file to hidden

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Drops file in System32 directory

System Location Discovery: System Language Discovery

Program crash

Enumerates physical storage devices

Browser Information Discovery

Suspicious use of FindShellTrayWindow

Views/modifies file attributes

Modifies registry class

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

NTFS ADS

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-14 05:26

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-14 05:26

Reported

2024-12-14 05:28

Platform

win10v2004-20241007-en

Max time kernel

47s

Max time network

95s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://wearedevs.net

Signatures

CrimsonRAT main payload

Description Indicator Process Target
N/A N/A N/A N/A

CrimsonRat

rat crimsonrat

Crimsonrat family

crimsonrat

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" C:\Users\Admin\Downloads\Blackkomet.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" C:\Users\Admin\Downloads\Blackkomet.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\rundll32.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Downloads MZ/PE file

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Downloads\Blackkomet.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\Downloads\Blackkomet.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" C:\Windows\SysWOW64\notepad.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" C:\Windows\SysWOW64\notepad.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" C:\Windows\SysWOW64\notepad.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" C:\Windows\SysWOW64\notepad.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" C:\Users\Admin\Downloads\Blackkomet.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" C:\Users\Admin\Downloads\Blackkomet.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\Windupdt\winupdate.exe C:\Users\Admin\Downloads\Blackkomet.exe N/A
File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe C:\Users\Admin\Downloads\Blackkomet.exe N/A
File created C:\Windows\SysWOW64\Windupdt\winupdate.exe C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
File opened for modification C:\Windows\SysWOW64\Windupdt\ C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
File created C:\Windows\SysWOW64\Windupdt\winupdate.exe C:\Users\Admin\Downloads\Blackkomet.exe N/A
File opened for modification C:\Windows\SysWOW64\Windupdt\ C:\Users\Admin\Downloads\Blackkomet.exe N/A
File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe C:\Users\Admin\Downloads\Blackkomet.exe N/A
File created C:\Windows\SysWOW64\Windupdt\winupdate.exe C:\Windows\SysWOW64\notepad.exe N/A
File opened for modification C:\Windows\SysWOW64\Windupdt\ C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
File created C:\Windows\SysWOW64\Windupdt\winupdate.exe C:\Windows\SysWOW64\notepad.exe N/A
File created C:\Windows\SysWOW64\Windupdt\winupdate.exe:SmartScreen:$DATA C:\Users\Admin\Downloads\Blackkomet.exe N/A
File opened for modification C:\Windows\SysWOW64\Windupdt\ C:\Users\Admin\Downloads\Blackkomet.exe N/A
File created C:\Windows\SysWOW64\Windupdt\winupdate.exe C:\Windows\SysWOW64\notepad.exe N/A
File created C:\Windows\SysWOW64\Windupdt\winupdate.exe C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
File created C:\Windows\SysWOW64\Windupdt\winupdate.exe C:\Windows\SysWOW64\notepad.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\notepad.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\Blackkomet.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\notepad.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\Blackkomet.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\notepad.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\notepad.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\notepad.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\notepad.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\Downloads\Blackkomet.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\Downloads\Blackkomet.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 854438.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 179813.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: 33 N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: 34 N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: 33 N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: 35 N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: 34 N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: 36 N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: 35 N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: 36 N/A C:\Users\Admin\Downloads\Blackkomet.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\Windupdt\winupdate.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 64 wrote to memory of 1056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 1056 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4044 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 3224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 3224 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 64 wrote to memory of 4308 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://wearedevs.net

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf63346f8,0x7ffcf6334708,0x7ffcf6334718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5308 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6588 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1208 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6908 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6996 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6988 /prefetch:8

C:\Users\Admin\Downloads\Blackkomet.exe

"C:\Users\Admin\Downloads\Blackkomet.exe"

C:\Users\Admin\Downloads\Blackkomet.exe

"C:\Users\Admin\Downloads\Blackkomet.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\Downloads\Blackkomet.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\Downloads" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\Downloads\Blackkomet.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\Downloads" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6628 /prefetch:8

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\CobaltStrike.doc" /o ""

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\CobaltStrike.doc" /o ""

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6688 /prefetch:8

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 8340 -ip 8340

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8340 -s 232

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 8672 -ip 8672

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8672 -s 128

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 9356 -ip 9356

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 9356 -s 348

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3680 /prefetch:1

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 8652 -ip 8652

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 8652 -s 80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2200,4334256071950157810,14058435074627684060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2164 -ip 2164

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 84

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Users\Admin\Downloads\CrimsonRAT.exe

"C:\Users\Admin\Downloads\CrimsonRAT.exe"

C:\Users\Admin\Downloads\CrimsonRAT.exe

"C:\Users\Admin\Downloads\CrimsonRAT.exe"

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\ProgramData\Hdlharas\dlrarhsiva.exe

"C:\ProgramData\Hdlharas\dlrarhsiva.exe"

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 12472 -ip 12472

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 12472 -s 84

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\ProgramData\Hdlharas\dlrarhsiva.exe

"C:\ProgramData\Hdlharas\dlrarhsiva.exe"

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt\winupdate.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Windows\SysWOW64\Windupdt" +s +h

C:\Windows\SysWOW64\Windupdt\winupdate.exe

"C:\Windows\system32\Windupdt\winupdate.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 wearedevs.net udp
US 104.26.6.147:80 wearedevs.net tcp
US 104.26.6.147:80 wearedevs.net tcp
US 104.26.6.147:443 wearedevs.net tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 147.6.26.104.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 cdn.wearedevs.net udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
FR 172.217.20.162:443 googleads.g.doubleclick.net tcp
US 162.159.134.233:443 cdn.discordapp.com tcp
US 162.159.134.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 www.google.co.uk udp
US 216.239.32.36:443 region1.analytics.google.com tcp
GB 74.125.71.154:443 stats.g.doubleclick.net tcp
FR 216.58.214.67:443 www.google.co.uk tcp
US 8.8.8.8:53 fundingchoicesmessages.google.com udp
FR 142.250.179.78:443 fundingchoicesmessages.google.com tcp
US 8.8.8.8:53 170.201.250.142.in-addr.arpa udp
US 8.8.8.8:53 168.201.250.142.in-addr.arpa udp
US 8.8.8.8:53 163.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 162.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 162.20.217.172.in-addr.arpa udp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 36.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 154.71.125.74.in-addr.arpa udp
US 8.8.8.8:53 67.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 110.179.250.142.in-addr.arpa udp
FR 142.250.179.78:443 fundingchoicesmessages.google.com udp
US 8.8.8.8:53 lh3.googleusercontent.com udp
FR 142.250.179.65:443 lh3.googleusercontent.com tcp
US 8.8.8.8:53 78.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 65.179.250.142.in-addr.arpa udp
GB 95.101.143.219:443 www.bing.com tcp
US 8.8.8.8:53 219.143.101.95.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 th.bing.com udp
US 8.8.8.8:53 r.bing.com udp
GB 95.101.143.219:443 r.bing.com tcp
GB 95.101.143.219:443 r.bing.com tcp
GB 95.101.143.219:443 r.bing.com tcp
GB 95.101.143.219:443 r.bing.com tcp
US 8.8.8.8:53 login.microsoftonline.com udp
IE 20.190.159.23:443 login.microsoftonline.com tcp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.109.133:443 avatars.githubusercontent.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 8.8.8.8:53 133.109.199.185.in-addr.arpa udp
US 8.8.8.8:53 154.110.199.185.in-addr.arpa udp
US 8.8.8.8:53 collector.github.com udp
US 185.199.110.154:443 github.githubassets.com tcp
US 8.8.8.8:53 api.github.com udp
US 140.82.112.22:443 collector.github.com tcp
US 140.82.112.22:443 collector.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 22.112.82.140.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 roaming.officeapps.live.com udp
NL 52.109.89.19:443 roaming.officeapps.live.com tcp
HK 149.129.72.37:23456 tcp
US 8.8.8.8:53 240.76.109.52.in-addr.arpa udp
US 8.8.8.8:53 19.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 metadata.templates.cdn.office.net udp
GB 92.123.26.217:443 metadata.templates.cdn.office.net tcp
US 8.8.8.8:53 binaries.templates.cdn.office.net udp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
GB 2.19.252.143:443 binaries.templates.cdn.office.net tcp
US 8.8.8.8:53 217.26.123.92.in-addr.arpa udp
US 8.8.8.8:53 143.252.19.2.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 e443ee4336fcf13c698b8ab5f3c173d0
SHA1 9bf70b16f03820cbe3158e1f1396b07b8ac9d75a
SHA256 79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
SHA512 cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

\??\pipe\LOCAL\crashpad_64_MHMTGLCVDZWUKVLE

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 56a4f78e21616a6e19da57228569489b
SHA1 21bfabbfc294d5f2aa1da825c5590d760483bc76
SHA256 d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
SHA512 c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 81b6a0c37ff5c566c64b1d7826e031f9
SHA1 72bde983bc101dcf9c1004e7ea061571ead82cc8
SHA256 8768f18f6744e8b80603f35ab8d5ae708f18040a94d377ff7f7e6b1f463d6a5f
SHA512 e5cb6545b0e0a2df7843223b2acb2edd5f360b3fcb2b309e3f1a44cba4290a62f2fe87f0ca38c2e112e9d9e55c2a3dd884e8ee18295d34a3e9d8ee58586b83b8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 3310a2dd94fe091aa13b0b2adb2e00c0
SHA1 307cb1f13a4948ba426e12286e336745d201ec6a
SHA256 53368878a575b2faa7404494ca30d3946817895c2357913be3ee5a7073e7c538
SHA512 1cd68d03cf4fe7cba6fdf0b3f8f86b59c23141c202fe22599f2e3de4dc57be92099419c346e842b6cb11f4dc75fd1298b17c4b32b6a1bf741903e0853cd16598

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4bfdf3155a5e9d065836233f83fc54e3
SHA1 7fdc015e5efac20f4c5dd2e19b228dc1765fc829
SHA256 fa17d0a3b4ea8ef2d30effbb1a158436f0a8bc2a7c27841d261f09cd05300c7b
SHA512 ed897769aeefa6d911328e952a530e9d5c897cde1014036bbaf1af14834bd624ba3094cdcec2717e02c6a3ee3ff01f2fdacb4425a088e85b8c14eaa469f9b396

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 443b1af1282bfd10f4e91deced60b39c
SHA1 1dbf4e03fe656a73f531eb904ba1da79f7e09c61
SHA256 a8bf07639965c356fc594e35b62af7c35c7f882bda8d028b460a0ad9cc7f31fb
SHA512 9d88741057a3f4d79d81fd33cb13bcf2e2d9bcbf62e05649f7ba83794d590f62154b7b4cc72aed42ad7c1c37e81317da1f8936e82816715cc556596c298f2451

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 04fb088e8d1e7d4f561115984e3f802c
SHA1 3406af5c1ce6f80d197a6449e54da534757c7d24
SHA256 d79b5bd9bb2e3b5b1446ed0f8063da43e71551ce1174aba0f3c156d51513a63b
SHA512 a8aa2170a52ec1797baddf7d7cc3efc1e0eaabe7ff4f4999d93f293c01bfd5711b979b63113e2125548732ed799ab16366e646a571801f8c8e89016eb1891675

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ef71.TMP

MD5 a13af927bb1494e98120d82ef498ad92
SHA1 89b7550e9a532d3075adeea4dab9d6cbd40a0f00
SHA256 b0897ad6d484dc9df8877c2abde75024d63fb0b193e58b27ff1e15f12328cb2d
SHA512 e62011fcc21804edf5e2de75bdf820003fd37b1edd3e144787a9a249d0c44be9dea282513d10820746e5dbbe95ac7f82574c9126b7187f72d1131aedd2a218ba

C:\Users\Admin\Downloads\Unconfirmed 854438.crdownload

MD5 fe537a3346590c04d81d357e3c4be6e8
SHA1 b1285f1d8618292e17e490857d1bdf0a79104837
SHA256 bbc572cced7c94d63a7208f4aba4ed20d1350bef153b099035a86c95c8d96d4a
SHA512 50a5c1ad99ee9f3a540cb30e87ebfdf7561f0a0ee35b3d06c394fa2bad06ca6088a04848ddcb25f449b3c98b89a91d1ba5859f1ed6737119b606968be250c8ce

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 99f8b65c8ecc0deb29a15a5917a37e19
SHA1 70c1c78869790dfdadcfcf38d19f5775b28dc062
SHA256 0d58e03581bc5e3cb0a9d659ed5160591934ce19d638cee1759360286fe7fa2a
SHA512 48b15168e04b9a2beb058691b04b0ba53055751c315ceb5265a24749ded091b8835f20ae6f8337c29081d8702c4cdf7b2938df39e73502d308c04a9fec8155f4

C:\Users\Admin\Downloads\Unconfirmed 179813.crdownload

MD5 c7dcd585b7e8b046f209052bcd6dd84b
SHA1 604dcfae9eed4f65c80a4a39454db409291e08fa
SHA256 0e8336ed51fe4551ced7d9aa5ce2dde945df8a0cc4e7c60199c24dd1cf7ccd48
SHA512 c5ba102b12d2c685312d7dc8d58d98891b73243f56a8491ea7c41c2edaaad44ad90b8bc0748dbd8c84e92e9ae9bbd0b0157265ebe35fb9b63668c57d0e1ed5f2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 379ccfece9c231f7d31ed4cc67e496cc
SHA1 ffa90ede1c38df42e442974ec4d55b8010a91e24
SHA256 26048bd3c068019d8c5c18c24e9ab4d984813baea06b8b28345d8d63345a654f
SHA512 44c15c2b016cc6bf743e969dec821345e66f0c3121f61fa5b6667706f328e41fa378719a76c0a7a36084a909f76486336e93117d52a81fc8a2d09e00f14cd04a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 1dc9d3cc8bf51d13bccea6500425ef45
SHA1 3bc7403ebca8e2c0cf0a1d599f4f44f957579f4b
SHA256 9ef55bead80d97c1f7e30639c80816e8cc04ed35a843bb1699bbfa1ecb87e2ac
SHA512 d0e56d4d676988cf7f2ed71ea260008ee5ef32121692de8c81d07ab09a8a8e9514595bb3aff1ac6a47556a8fc1e7ad6a77e4950324158336558cdae3ff0c5072

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 f4ae334a60b310c1d4d283839244ad66
SHA1 a8986b844ad780df36dd4abc50696a6e9619461c
SHA256 975e9d440a9d6ae01db61e21c58f6915b986f30b6395e1b51e44da7a62c3d471
SHA512 33c89dc57443860e38feb176c75a6080dd3fe3e5a9d15be5255a1560ad6b631c9e246adb25aa28ce6481653a061e1b8afdd02d98a66e3eb8d4bc5e9673ab2045

memory/3524-468-0x0000000000F20000-0x0000000000F21000-memory.dmp

memory/5180-474-0x0000000000770000-0x0000000000771000-memory.dmp

memory/4984-476-0x0000000013140000-0x000000001320F000-memory.dmp

memory/1196-478-0x0000000013140000-0x000000001320F000-memory.dmp

memory/5204-485-0x0000000013140000-0x000000001320F000-memory.dmp

memory/5452-489-0x0000000013140000-0x000000001320F000-memory.dmp

memory/5920-493-0x0000000013140000-0x000000001320F000-memory.dmp

memory/5960-497-0x0000000013140000-0x000000001320F000-memory.dmp

memory/536-504-0x0000000013140000-0x000000001320F000-memory.dmp

memory/5232-507-0x0000000013140000-0x000000001320F000-memory.dmp

memory/5904-524-0x0000000013140000-0x000000001320F000-memory.dmp

memory/5840-523-0x0000000013140000-0x000000001320F000-memory.dmp

memory/5932-535-0x0000000013140000-0x000000001320F000-memory.dmp

memory/6064-534-0x0000000013140000-0x000000001320F000-memory.dmp

memory/5432-540-0x0000000013140000-0x000000001320F000-memory.dmp

memory/1624-544-0x0000000013140000-0x000000001320F000-memory.dmp

memory/5152-548-0x0000000013140000-0x000000001320F000-memory.dmp

memory/5888-552-0x0000000013140000-0x000000001320F000-memory.dmp

C:\Users\Admin\Downloads\CobaltStrike.doc

MD5 96ff9d4cac8d3a8e73c33fc6bf72f198
SHA1 17d7edf6e496dec4695d686e7d0e422081cd5cbe
SHA256 96db5d52f4addf46b0a41d45351a52041d9e5368aead642402db577bcb33cc3d
SHA512 23659fb32dff24b17caffaf94133dac253ccde16ea1ad4d378563b16e99cb10b3d7e9dacf1b95911cd54a2cad4710e48c109ab73796b954cd20844833d3a7c46

memory/6128-561-0x0000000013140000-0x000000001320F000-memory.dmp

memory/5788-560-0x0000000013140000-0x000000001320F000-memory.dmp

memory/1824-565-0x0000000013140000-0x000000001320F000-memory.dmp

memory/3216-567-0x0000000013140000-0x000000001320F000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 809d633540027420b61361200f3373e8
SHA1 34b25e89cd41bada728b8990b844c424679a191a
SHA256 e384a82096f44457f22ff7e07713d1cc9ab5b46c41df84ab45372296e554e3f0
SHA512 a02ae3f32364b9fdaa50866ab01df5ec673dd1b425a199065e290e8f2c50e99e681d17e2b1a23d1a4e9da99ededef9dea9eb9abaa42d7ec8a9145e5299e10101

C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Users\Admin\Downloads\Unconfirmed 588691.crdownload

MD5 b6e148ee1a2a3b460dd2a0adbf1dd39c
SHA1 ec0efbe8fd2fa5300164e9e4eded0d40da549c60
SHA256 dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba
SHA512 4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 9ec5c141e948eeee7bcd4b3825286786
SHA1 fd035ce62068cedf179cb148e3c4b2eb1dc4c6e1
SHA256 670b84bf27a965b195448a81b168c0eb3e09dfa0f22fae5f063009c98f614aad
SHA512 351040110b273a77fd0832cf3ffa37c1bf93a4afa300d779e03393ae15823d2460e32ed054a1319f307737d1a0b25a7a31af99530596a75f1f84fa924ba08083

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

MD5 48f0f4e3cb8d5478be2ff70bcd8f3648
SHA1 cca1198680a9ade76defaffcb39cc41376c89eb4
SHA256 8570b03844276cab1edf843cc9fedae5682e85ae6804cbf0221beeb866a2b8d7
SHA512 0e67590b5081c2c30edfb0b8e690561f7d74e827983a86882e9a246a6162577546bfa85e89a8191372876acbffd151d99ed35e11bc9bfaae8bbf8c0f0b71e1ff

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 b10e0a7241ab998e8996c50af7f5e3f3
SHA1 8d5fdc4ff1002968b65d30c7145e8a32258baebc
SHA256 39eb6a78d27b3a65ac8818482c0f3dc20413f0ffb7531385d8a25d51d890bdd3
SHA512 c1dc5f06e4c2dc5abcc46b58875d5aeead26b6de9ad90aa2bc0ca3de30e8430e7e4c12163ed7bb215761e1b3a43304004e70132d39c5de823091266cfc14a9f3

C:\Users\Admin\AppData\Local\Temp\TCDACF1.tmp\gb.xsl

MD5 51d32ee5bc7ab811041f799652d26e04
SHA1 412193006aa3ef19e0a57e16acf86b830993024a
SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 cc1c8aa41b9d59750d249820a23d4778
SHA1 7c51d3863f5b99973cf405903b6ecebb41df4fae
SHA256 475e598ca467dbfe604e6af60af7cf13d3793f5393777e904afc5305b5b2e0e3
SHA512 7ad33dd290f7a922347265dde9c01f28cf60153bffe6921c143ff74bc7682bd2c87e3da87b76096b4a513ce0b18df58876eb303033645025b3fb97b250d55bbc

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 060a2e5af607b10af0de5ceb995c2dff
SHA1 64f8b361be04f99cb5dd10752624789f904e2539
SHA256 3d990a0f3785205d4d002652188336eed37548a9ccaceb7ba026a4c57bbd7d6c
SHA512 05920e0772a9f98a542dcdee582df892b769754fc7205589f6b3e14c084d826ab4174aa665b9696ca8d5ac159aaf260d479ee4c8e6d40965af7af3ccb851933d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 b1eb64765fc88e6e7f43f9ecc2ad7d42
SHA1 b05610d7a0a8ac142a35da74eb282c4dc2c953f7
SHA256 9f6f93ad2325d7087d43255bb784f77315b94b290d53fa290cf6aa450a5acbe1
SHA512 4042e37a1814bcec49f8aaef02561e44d2a10f70bfcdcd5d9a230357d6bbfd21ec3560e74a0f3ae3f9fc345c499862c54337e52f9f733fbdc2c3da9ebe29f383

memory/9760-1477-0x0000019FCFB90000-0x0000019FCFBAE000-memory.dmp

C:\ProgramData\Hdlharas\mdkhm.zip

MD5 b635f6f767e485c7e17833411d567712
SHA1 5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8
SHA256 6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e
SHA512 551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

memory/11396-1497-0x0000022B134F0000-0x0000022B13E04000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 d1c72448eabeb26decdb913d37c917a6
SHA1 d73cff5c292eb62fc99926a363e3f843e6ba0f6c
SHA256 e4cc11f58aafcd2f02c9c19938729306b3d6f083f21f1b59c2b25b4e3b1d4c6c
SHA512 88bf5959780c6815856a8c06cb1ffe6c660b75460d58feb5a73bad5cf34c3abd6a82845078aed1b57668027166ca83c3f590728dcf91fdc21727b2766fe6723c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 7528651babc4b5b7452f37aa91e1aa23
SHA1 352cdc9bb67b80e2899c59ba27f1bf4485f0ee94
SHA256 5fce6b6eaaf4efcbf1c7b224e5dc51bb56a40a0015568879ff987395a61b8853
SHA512 82e26a59f42253a907331b519559fbdb05078239322bbd539244ce9c23b965ca6086e0cc7da64c1ca3521ca97754d8f5a74a6afce198a8511ba6e5eeb32480f2

C:\ProgramData\Hdlharas\dlrarhsiva (2).exe

MD5 64261d5f3b07671f15b7f10f2f78da3f
SHA1 d4f978177394024bb4d0e5b6b972a5f72f830181
SHA256 87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad
SHA512 3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 eda5402d47572740e85bd2daf1974fe7
SHA1 eaffb565e27e6c8e3266b111564a5b25cd47cf7f
SHA256 f88f6ce17bbc07daa6653b84b034717815cadd6768f3fb9a54762f9213b9a535
SHA512 f65aef04877312bb8135efe5471357bc89f2558861939faf6673f6abb4852113992f892eb7ae858338b58c8480fa3c80380924da3c007f08c11e14f65cae3270