1d7888d4cc9c9ca665f8393ffb0bfa1c9a5011da61d35d8d2bcda24342dbb758

Analysis

max time kernel
150s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
08/11/2025, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Test.exe
Size 164.7MB
Sample251108-bgh2faat4a
SHA256 e9e5b7bd85413171dbc4bb28a5e22d147011612af92b388a0293aa6b6c99964a
MD5 25da390e732671d5acd2ccf4c3534acc
SHA1 015671e807bf6308df631c1250f713524a9385ec
SHA512 22b0f695664abfe8b8908bc39094aa215339dc28d832aed5bf3776afd501058a4f3f185f3321ae1f36f58ad9f6dd4cbf32a8ce8e895860240525432cedd182f0
SSDEEP 1572864:M3lB0RhDP7igv6wO+HkaN/xtpj56BZWua2T3jC0gqhd07YeRt6C1Bd1jKoUeKtQk:JPvt1x2z5m1ij
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2492	Test.exe
5476	Test.exe
4808	decryptor.exe

Loads dropped DLL 5 IoCs

pid	Process
5636	Test.exe
5636	Test.exe
3956	Test.exe
3956	Test.exe
5636	Test.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Windows\CurrentVersion\Run\Test = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Test.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_Health_Courtage_0e07r7 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\Test.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows_Health_Courtage_0e07r7 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\Test.exe"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 32 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3740	powershell.exe
5468	powershell.exe
3384	powershell.exe
700	powershell.exe
3532	powershell.exe
5360	powershell.exe
2772	powershell.exe
1292	powershell.exe
2960	powershell.exe
5044	powershell.exe
5472	powershell.exe
4100	powershell.exe
4336	powershell.exe
1548	powershell.exe
1016	powershell.exe
5664	powershell.exe
4712	powershell.exe
5104	powershell.exe
1060	powershell.exe
4696	powershell.exe
4552	powershell.exe
5884	powershell.exe
912	powershell.exe
5052	powershell.exe
4068	powershell.exe
796	powershell.exe
5748	powershell.exe
852	powershell.exe
2740	powershell.exe
2212	powershell.exe
3308	powershell.exe
5820	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
127	api.gofile.io
1	raw.githubusercontent.com
1	api.gofile.io
9	raw.githubusercontent.com
16	raw.githubusercontent.com
39	raw.githubusercontent.com
43	raw.githubusercontent.com
61	raw.githubusercontent.com

Looks up external IP address via web service 21 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
35	ipinfo.io
4	ipinfo.io
5	ipinfo.io
6	ipinfo.io
18	ipinfo.io
19	ipinfo.io
21	ipinfo.io
51	ipinfo.io
29	ipinfo.io
30	ipinfo.io
34	ipinfo.io
7	ipinfo.io
20	ipinfo.io
52	ipinfo.io
3	ipinfo.io
28	ipinfo.io
36	ipinfo.io
37	ipinfo.io
49	ipinfo.io
50	ipinfo.io
56	ipinfo.io

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4452	tasklist.exe
2460	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2452	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Test.exe

Detects videocard installed 1 TTPs 5 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3360	WMIC.exe
3720	WMIC.exe
1840	WMIC.exe
5136	WMIC.exe
5976	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 16 IoCs

defense_evasion

pid	Process
5888	taskkill.exe
2672	taskkill.exe
4152	taskkill.exe
2760	taskkill.exe
740	taskkill.exe
5604	taskkill.exe
2156	taskkill.exe
5140	taskkill.exe
5096	taskkill.exe
5384	taskkill.exe
1704	taskkill.exe
3476	taskkill.exe
1184	taskkill.exe
5232	taskkill.exe
5232	taskkill.exe
3432	taskkill.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Edge_cookies.txt:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\80f635b8-859b-48ef-9b25-a04300c6f8fb\fallback-cookies\Edge_cookies.txt\:Zone.Identifier:$DATA	Test.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5584	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5636	Test.exe
5636	Test.exe
5636	Test.exe
5636	Test.exe
5104	powershell.exe
5104	powershell.exe
2452	powershell.exe
2452	powershell.exe
3532	powershell.exe
5044	powershell.exe
3532	powershell.exe
5044	powershell.exe
5052	powershell.exe
5052	powershell.exe
1060	powershell.exe
1060	powershell.exe
5824	powershell.exe
5824	powershell.exe
4068	powershell.exe
4068	powershell.exe
5104	powershell.exe
4068	powershell.exe
5052	powershell.exe
3532	powershell.exe
1060	powershell.exe
5044	powershell.exe
2452	powershell.exe
5824	powershell.exe
5636	Test.exe
5636	Test.exe
5636	Test.exe
5636	Test.exe
4696	powershell.exe
4696	powershell.exe
1536	powershell.exe
1536	powershell.exe
2772	powershell.exe
2772	powershell.exe
5360	powershell.exe
5360	powershell.exe
5472	powershell.exe
5472	powershell.exe
2212	powershell.exe
2212	powershell.exe
4552	powershell.exe
4552	powershell.exe
648	powershell.exe
648	powershell.exe
4696	powershell.exe
4696	powershell.exe
3308	powershell.exe
3308	powershell.exe
2772	powershell.exe
5360	powershell.exe
5472	powershell.exe
1536	powershell.exe
2212	powershell.exe
4552	powershell.exe
648	powershell.exe
3956	Test.exe
3956	Test.exe
3956	Test.exe
3956	Test.exe
3308	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5636	Test.exe
Token: SeCreatePagefilePrivilege	5636	Test.exe
Token: SeIncreaseQuotaPrivilege	3780	WMIC.exe
Token: SeSecurityPrivilege	3780	WMIC.exe
Token: SeTakeOwnershipPrivilege	3780	WMIC.exe
Token: SeLoadDriverPrivilege	3780	WMIC.exe
Token: SeSystemProfilePrivilege	3780	WMIC.exe
Token: SeSystemtimePrivilege	3780	WMIC.exe
Token: SeProfSingleProcessPrivilege	3780	WMIC.exe
Token: SeIncBasePriorityPrivilege	3780	WMIC.exe
Token: SeCreatePagefilePrivilege	3780	WMIC.exe
Token: SeBackupPrivilege	3780	WMIC.exe
Token: SeRestorePrivilege	3780	WMIC.exe
Token: SeShutdownPrivilege	3780	WMIC.exe
Token: SeDebugPrivilege	3780	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3780	WMIC.exe
Token: SeRemoteShutdownPrivilege	3780	WMIC.exe
Token: SeUndockPrivilege	3780	WMIC.exe
Token: SeManageVolumePrivilege	3780	WMIC.exe
Token: 33	3780	WMIC.exe
Token: 34	3780	WMIC.exe
Token: 35	3780	WMIC.exe
Token: 36	3780	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3360	WMIC.exe
Token: SeSecurityPrivilege	3360	WMIC.exe
Token: SeTakeOwnershipPrivilege	3360	WMIC.exe
Token: SeLoadDriverPrivilege	3360	WMIC.exe
Token: SeSystemProfilePrivilege	3360	WMIC.exe
Token: SeSystemtimePrivilege	3360	WMIC.exe
Token: SeProfSingleProcessPrivilege	3360	WMIC.exe
Token: SeIncBasePriorityPrivilege	3360	WMIC.exe
Token: SeCreatePagefilePrivilege	3360	WMIC.exe
Token: SeBackupPrivilege	3360	WMIC.exe
Token: SeRestorePrivilege	3360	WMIC.exe
Token: SeShutdownPrivilege	3360	WMIC.exe
Token: SeDebugPrivilege	3360	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3360	WMIC.exe
Token: SeRemoteShutdownPrivilege	3360	WMIC.exe
Token: SeUndockPrivilege	3360	WMIC.exe
Token: SeManageVolumePrivilege	3360	WMIC.exe
Token: 33	3360	WMIC.exe
Token: 34	3360	WMIC.exe
Token: 35	3360	WMIC.exe
Token: 36	3360	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3648	WMIC.exe
Token: SeSecurityPrivilege	3648	WMIC.exe
Token: SeTakeOwnershipPrivilege	3648	WMIC.exe
Token: SeLoadDriverPrivilege	3648	WMIC.exe
Token: SeSystemProfilePrivilege	3648	WMIC.exe
Token: SeSystemtimePrivilege	3648	WMIC.exe
Token: SeProfSingleProcessPrivilege	3648	WMIC.exe
Token: SeIncBasePriorityPrivilege	3648	WMIC.exe
Token: SeCreatePagefilePrivilege	3648	WMIC.exe
Token: SeBackupPrivilege	3648	WMIC.exe
Token: SeRestorePrivilege	3648	WMIC.exe
Token: SeShutdownPrivilege	3648	WMIC.exe
Token: SeDebugPrivilege	3648	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3648	WMIC.exe
Token: SeRemoteShutdownPrivilege	3648	WMIC.exe
Token: SeUndockPrivilege	3648	WMIC.exe
Token: SeManageVolumePrivilege	3648	WMIC.exe
Token: 33	3648	WMIC.exe
Token: 34	3648	WMIC.exe
Token: 35	3648	WMIC.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5188	5636	Test.exe	78
PID 5636 wrote to memory of 5236	5636	Test.exe	79
PID 5636 wrote to memory of 5236	5636	Test.exe	79
PID 5636 wrote to memory of 5400	5636	Test.exe	80
PID 5636 wrote to memory of 5400	5636	Test.exe	80
PID 5636 wrote to memory of 4384	5636	Test.exe	81
PID 5636 wrote to memory of 4384	5636	Test.exe	81
PID 5636 wrote to memory of 428	5636	Test.exe	83
PID 5636 wrote to memory of 428	5636	Test.exe	83
PID 5636 wrote to memory of 3524	5636	Test.exe	84
PID 5636 wrote to memory of 3524	5636	Test.exe	84
PID 5636 wrote to memory of 2476	5636	Test.exe	86
PID 5636 wrote to memory of 2476	5636	Test.exe	86
PID 5636 wrote to memory of 3112	5636	Test.exe	87
PID 5636 wrote to memory of 3112	5636	Test.exe	87
PID 5636 wrote to memory of 4124	5636	Test.exe	88
PID 5636 wrote to memory of 4124	5636	Test.exe	88
PID 5636 wrote to memory of 3900	5636	Test.exe	89
PID 5636 wrote to memory of 3900	5636	Test.exe	89
PID 5636 wrote to memory of 5240	5636	Test.exe	90
PID 5636 wrote to memory of 5240	5636	Test.exe	90
PID 5636 wrote to memory of 5708	5636	Test.exe	92
PID 5636 wrote to memory of 5708	5636	Test.exe	92
PID 5636 wrote to memory of 3592	5636	Test.exe	94
PID 5636 wrote to memory of 3592	5636	Test.exe	94
PID 2476 wrote to memory of 3360	2476	cmd.exe	102
PID 2476 wrote to memory of 3360	2476	cmd.exe	102
PID 428 wrote to memory of 3780	428	cmd.exe	103
PID 428 wrote to memory of 3780	428	cmd.exe	103
PID 428 wrote to memory of 3492	428	cmd.exe	104
PID 428 wrote to memory of 3492	428	cmd.exe	104
PID 3524 wrote to memory of 3648	3524	cmd.exe	105
PID 3524 wrote to memory of 3648	3524	cmd.exe	105
PID 3524 wrote to memory of 2412	3524	cmd.exe	106
PID 3524 wrote to memory of 2412	3524	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Test.exe
"C:\Users\Admin\AppData\Local\Temp\Test.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Users\Admin\AppData\Local\Temp\Test.exe
  "C:\Users\Admin\AppData\Local\Temp\Test.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1824 --field-trial-handle=1828,i,827309989178538660,9885959582345668359,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:5188
- C:\Users\Admin\AppData\Local\Temp\Test.exe
  "C:\Users\Admin\AppData\Local\Temp\Test.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --mojo-platform-channel-handle=1892 --field-trial-handle=1828,i,827309989178538660,9885959582345668359,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:5236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  PID:5400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  PID:4384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3780
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:3492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:2412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:3360
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:3112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  PID:4124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  PID:3900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  PID:5240
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  PID:5708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  PID:3592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test""
  2⤵
  PID:3472
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test"
    3⤵
    PID:5868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Test /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Test.exe" /f"
  2⤵
  PID:2328
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Test /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Test.exe" /f
    3⤵
    - Adds Run key to start application
    PID:1348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  PID:4644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  PID:4020
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  PID:1884
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    PID:4764
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  PID:4608
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:2836
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  PID:4060
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3720
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:2884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  PID:2832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  PID:700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  PID:3000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  PID:4424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  PID:1292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ItemProperty -Path \"HKCU:\SOFTWARE\Valve\Steam\" -Name \"SteamPath\" | Select-Object -ExpandProperty SteamPath"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Windows_Health_Courtage_0e07r7 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe" /f"
  2⤵
  PID:1460
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Windows_Health_Courtage_0e07r7 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe" /f
    3⤵
    - Adds Run key to start application
    PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Windows_Health_Courtage_0e07r7 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe" /f"
  2⤵
  PID:2032
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Windows_Health_Courtage_0e07r7 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe" /f
    3⤵
    - Adds Run key to start application
    PID:4976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "try { $Action = New-ScheduledTaskAction -Execute "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Test.exe"; $Trigger = New-ScheduledTaskTrigger -Daily -At "12:00PM"; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable; Register-ScheduledTask -Action $Action -Trigger $Trigger -Settings $Settings -TaskName "DailySystemUpdate_g4xbuq" -Force -User $env:USERNAME; Write-Host "TASK_CREATED_SUCCESS" } catch { Write-Host "TASK_CREATED_ERROR: $($_.Exception.Message)" }""
  2⤵
  PID:2416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "try { $Action = New-ScheduledTaskAction -Execute "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Test.exe"; $Trigger = New-ScheduledTaskTrigger -Daily -At "12:00PM"; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable; Register-ScheduledTask -Action $Action -Trigger $Trigger -Settings $Settings -TaskName "DailySystemUpdate_g4xbuq" -Force -User $env:USERNAME; Write-Host "TASK_CREATED_SUCCESS" } catch { Write-Host "TASK_CREATED_ERROR: $($_.Exception.Message)" }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupmxu29i /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe\" /F /rl highest"
  2⤵
  PID:3384
- - C:\Windows\system32\cmd.exe
    cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupmxu29i /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe\" /F /rl highest
    3⤵
    PID:5748
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /sc onlogon /tn WindowsDriverSetupmxu29i /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe\" /F /rl highest
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  PID:768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  PID:5876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  PID:2208
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    PID:4824
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:5780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  PID:5912
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:3096
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  PID:1316
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:5136
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:3340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:5836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  PID:3148
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    PID:5704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  PID:5216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  PID:6004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  PID:2492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  PID:916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-ScheduledTask -TaskName 'DailySystemUpdate_g4xbuq' -ErrorAction SilentlyContinue | Select-Object TaskName, State""
  2⤵
  PID:4060
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-ScheduledTask -TaskName 'DailySystemUpdate_g4xbuq' -ErrorAction SilentlyContinue | Select-Object TaskName, State"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    PID:2452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:5848
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:4152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
  2⤵
  PID:1008
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:2156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
  2⤵
  PID:3836
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:2760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
  2⤵
  PID:5360
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:960
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:3432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
  2⤵
  PID:5924
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:1704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
  2⤵
  PID:4896
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe
    3⤵
    - Kills process with taskkill
    PID:5140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
  2⤵
  PID:648
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe
    3⤵
    - Kills process with taskkill
    PID:740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
  2⤵
  PID:5208
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM centbrowser.exe
    3⤵
    - Kills process with taskkill
    PID:5888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
  2⤵
  PID:4000
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM 7star.exe
    3⤵
    - Kills process with taskkill
    PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
  2⤵
  PID:3648
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM sputnik.exe
    3⤵
    - Kills process with taskkill
    PID:3476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
  2⤵
  PID:3400
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:5604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
  2⤵
  PID:5476
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM epicprivacybrowser.exe
    3⤵
    - Kills process with taskkill
    PID:5384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
  2⤵
  PID:3032
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe
    3⤵
    - Kills process with taskkill
    PID:1184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
  2⤵
  PID:2508
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
  2⤵
  PID:5588
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM iridium.exe
    3⤵
    - Kills process with taskkill
    PID:2672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3352
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1948
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2460
- C:\Users\Admin\AppData\Local\Temp\decryptor_3093413d-7e71-4faf-ba1c-0156f2903ebe\decryptor.exe
  C:\Users\Admin\AppData\Local\Temp\decryptor_3093413d-7e71-4faf-ba1c-0156f2903ebe\decryptor.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "--load-extension=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Edge" "--disable-extensions-except=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Edge" --disable-popup-blocking --no-first-run --no-default-browser-check --disable-session-crashed-bubble --window-size=800,600 --window-position=-32000,-32000
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:1572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffa92acf208,0x7ffa92acf214,0x7ffa92acf220
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1864,i,13773381977732543284,17715466234947731825,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
    3⤵
    PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2144,i,13773381977732543284,17715466234947731825,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:1220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2516,i,13773381977732543284,17715466234947731825,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3472,i,13773381977732543284,17715466234947731825,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:5544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3480,i,13773381977732543284,17715466234947731825,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4632,i,13773381977732543284,17715466234947731825,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:9
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3476,i,13773381977732543284,17715466234947731825,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:5632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5196,i,13773381977732543284,17715466234947731825,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
    3⤵
    PID:3420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5292,i,13773381977732543284,17715466234947731825,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5200,i,13773381977732543284,17715466234947731825,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
    3⤵
    - NTFS ADS
    PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6152,i,13773381977732543284,17715466234947731825,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
    3⤵
    PID:4452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6160,i,13773381977732543284,17715466234947731825,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
    3⤵
    PID:5160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6168,i,13773381977732543284,17715466234947731825,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
    3⤵
    PID:3352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
  2⤵
  PID:6064
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:5232
- C:\Users\Admin\AppData\Local\Temp\Test.exe
  "C:\Users\Admin\AppData\Local\Temp\Test.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2936 --field-trial-handle=1828,i,827309989178538660,9885959582345668359,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:5688

C:\Users\Admin\AppData\Local\Temp\Test.exe
C:\Users\Admin\AppData\Local\Temp\Test.exe
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3956
- C:\Users\Admin\AppData\Local\Temp\Test.exe
  "C:\Users\Admin\AppData\Local\Temp\Test.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,10106350777543277367,12120311532811552731,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:2800
- C:\Users\Admin\AppData\Local\Temp\Test.exe
  "C:\Users\Admin\AppData\Local\Temp\Test.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --mojo-platform-channel-handle=1804 --field-trial-handle=1768,i,10106350777543277367,12120311532811552731,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:1204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  PID:3520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  PID:1272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  PID:1584
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    PID:4900
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:5068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  PID:2228
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:3692
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:5544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  PID:4200
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1840
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  PID:2100
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    PID:4008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  PID:3424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  PID:4012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  PID:4940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  PID:4884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test""
  2⤵
  PID:3360
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test"
    3⤵
    PID:2348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  PID:3104
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  PID:2016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  PID:5692
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    PID:2228
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  PID:4520
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:6016
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:2300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  PID:3648
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:5976
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:5096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:5536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    PID:5052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  PID:4592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  PID:5028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  PID:6136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  PID:4864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  PID:2836
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:700
- C:\Users\Admin\AppData\Local\Temp\Test.exe
  "C:\Users\Admin\AppData\Local\Temp\Test.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3176 --field-trial-handle=1768,i,10106350777543277367,12120311532811552731,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:5056

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe
1⤵
- Executes dropped EXE
PID:2492

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe"
1⤵
- Executes dropped EXE
PID:5476

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\19180fc3d0ac69ce\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 d5454269a54839a87526cbaa50589abb293da667000a424f1cd203e92e0c1e2f
MD5 9c7a5faf54fd84a35536c17ed9893123
SHA1 03cce4fa66871d99a999660308926493a1293892
SHA512 e86e8667722cec842408fe9c325efb0d766b4824fc86ac48eca7c9de472ad7a7356aa484b13f438cd08323f9446e721c80392558d40cb2bee9c2eccf770c7a77
SSDEEP 3:Bjl9/lGlll/l/lXp9ZjrPBY0dlCHgEllRP:dH0dPBY0dE/J
MD5 SHA1 SHA512 SSDEEP

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\19180fc3d0ac69ce\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\19180fc3d0ac69ce\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 976B
SHA256 bb2891b0d9351568596d613827a0a5084e3782842dc915ed720206d34e02ba48
MD5 827b7dc14ff269642f0f383c39567493
SHA1 d82029fd2857734b0ccda1b937675bcae6398201
SHA512 6ca2d254fba82fb084e097b5f94418f8d541a6fc16ab62e1b90646faf117651761ea242c2258253bf6bfcf1f4d9d43531e9617081c59958e18fad6c7176086b8
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e373291cec4f23986133c23daa353551f05eda26aac4a4e3686c40f8bfda576e
MD5 03b6ceee6d3294b477cb96be0a4821a2
SHA1 17508a8b887dac0d5b2fdf62cce6ee7989564165
SHA512 581fbd959baff647df5ac757c03b071653bca94c529807775b30e0f4b88ade1f0dd99850daaea1fa0861ce83d3e9d505a004e6c78d45e923ee39728a2d9efda9
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8eec7701cb60128b2dc98f32e9cfa4da8e6b58ee9c1c8e3b48a146f8900df730
MD5 96eb6b1c38c424dabb768bb6eb5e65dc
SHA1 8fda1e0502313179f4d37386b06524acd45a3026
SHA512 c71bcda9f24676953dfff26f3223822913e8187560a3b96e10ee8f5764ef9ec0d4596592325ad4a5bfd8cd0f10b6cc5440da0dc66ca60272ce58356e8cc4c4a4
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5975a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5975a3.TMP
Size 1KB
SHA256 59819d2244ef52ff23455a162ee3c2725ee9d1b9a915d8fb523ce656baa8e4f7
MD5 6192c1c94f8e4fe06d829237140434b4
SHA1 e91000c963516b2fc88bdb0fe4e4762809647c21
SHA512 d9405eb7b47e00652152b422763930fe189382f37bcee56f70029cdaed5e12218b430dfe0b20863b4d1cf906e6b00832c20a054c6d1ed05ce551479f1a38b7f3
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

cf4e0d26-ef31-4786-a8a7-7d1d5d42c1e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cf4e0d26-ef31-4786-a8a7-7d1d5d42c1e1.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a47067ffa506a49d5495b303e1b27e2c70d0e75866b62b93ea7a8bbeba35fc17
MD5 215e8ff15319eb5a93086d293f61476e
SHA1 279ac794506e2d85dc7bb7678489443b97b5fbe1
SHA512 ed8c7408468b7d9198ad0ce4bad58b9695329e8947751940100a1a8cf6ac4a61d7ba07fe94540b9d572721c3f108555d4eeba01dd3bc4c5a432bc38675c4d796
SSDEEP 192:sVjRoyMqv/Ky0Ml8MJMEBsnfv/vqCzSAoZ8pRG/Y+WNnQEwY0z+0rfvakZcIgLJ:sVjDL+EBsfvXOAns/SPw5nfvNAd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 189656e36606b4062404adf1ad42a228f762823aa6180c3e9286a1f5134dd477
MD5 ddcedc382ae30bfe8f3390ab6c4ff652
SHA1 13fa52dd98ad39b5d96922208790e92f7159511c
SHA512 0a1722788af2a69f1db19a91993c4a7ecae29a275d483788561c89ceda49006b0b8fa01e060496cbdb0db380d0041f6206462957ba792b0d90f522c0432ece63
SSDEEP 768:KaB7a8GX2oqWRWFTQBD8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3ToLl/SI0GOLYmrE:KaB7a8GX2oqWRWFTQBDu1jaKToLpS5Gp
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4067e4c2-833e-455f-b5a4-bd0d7bf066c9\index-dir\the-real-index
Size 72B
SHA256 a329c18467dff921e12450c7c5e0cef2830876ce22c1dd2e6835c6ba57550681
MD5 f363eb44b54482cf8a9c751556eb8b99
SHA1 012c9c743ee2532ffb40bc829f24a177759edb99
SHA512 2709d30450132e8c00b1f9f040d4d1bd1e92fecd0487d6436c9bb1e74c20e549752a3850dfba1ff866c39ab9ece74caf830f50ced88c381b3746222db477ff58
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5975b3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4067e4c2-833e-455f-b5a4-bd0d7bf066c9\index-dir\the-real-index~RFe5975b3.TMP
Size 48B
SHA256 fc7a76dbdb6653fe82f5252665852b1c4fde3aa063b54261ed5f16233a2eccae
MD5 161d9c098a4503f3b795f613aa3cf9f3
SHA1 accde94e761d9342a8691ee76b309231f0960d19
SHA512 dd98442b3d2db59108cb6ad60b6505220789c8e25a785da24788ba54777a3173a9d3353d14e9186c00554734a1e9873b54169766cd7ee3249ba7299f677f35b3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d659879c-d8b4-4800-b4b5-b3234f7854fe\index-dir\the-real-index
Size 1KB
SHA256 3a4a0ca9ecc79d078c74ff823067b5515026bda9273a607242c5e3cf840b1982
MD5 833cff1dd79b0cebcbad60c20ad9108f
SHA1 227a21aa5bf3e48b939e2899b22cf44d0c6d90cf
SHA512 8f7d78a61682469d596aefebb07a49bf2b9ac7db4187112ed09212afa2764b730b0d06499ce2beb9c5fe1267f3b4aa43ff24b2029bc09dc44d6e15023a154947
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe59233e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d659879c-d8b4-4800-b4b5-b3234f7854fe\index-dir\the-real-index~RFe59233e.TMP
Size 1KB
SHA256 e596945ec5e1cde0bd419ba8e0a61caaaac27cf3027c15f5533509e3750bccb0
MD5 565621168aa6d04902e7aa4aaf796951
SHA1 d6408a29571e3867f26ede4cf42247be3539fa35
SHA512 2db1491b1898b93257070109e1bd9737623a90af0e2034674a639f637526768d7a88b543aca5308e9a4493cd2ca047a5e0f41b775c8f26f9109eb343ff5ea409
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 325B
SHA256 07f4526f987622471ad4413f3e0f2476975ea4726089a49aab1b1090ebc1a3bc
MD5 c1fd8464b55a229b9c0ae222e128449f
SHA1 acca4a07c3b0f2d094fdd5ed0d26590e7ae22e73
SHA512 54f7fc3d7dfa10f24097127a55af28c071c6c046df5cbfbea62edf4d8f8561462b9f271968928854a280b5253fda95be917414da0c168fab592f722d5c843636
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 320B
SHA256 38236d94eea8c6fb092108156514506721dfe69b7a5babd92f837486dabaf704
MD5 20629afb0b39d024cabd160f8dc158b2
SHA1 8c5d8a553bfd105fb054fbec6c96c650cbfe09e5
SHA512 c552ff5b324fea24d6f948661b0b1152d7777cde31e04fa38219a3fd63225fe47948bc6f61e8a03716dc1fceb16b686967dbb725b10a47eec90b617cfa503d98
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 3d95330811ea5ef48a7d2ae058eb50183e61d65233f7b6c3fe156e32e2572253
MD5 c6ac48416f1367817bdd8023a1ffa717
SHA1 51e523d690933d25b216b8c57ac0788415d04791
SHA512 0d4ea3e0ea1d0993ca68f945d37ab3d87342da17f50c469edf05b1fa8d5762397c90cffde8f586c2c047d4f9caea5b88536f95b9bf5dfcd2ad0783fc4f8e56db
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe596c5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596c5c.TMP
Size 72B
SHA256 7ecd8c089e69a1e96612aebc8c19699bee2ec7619a320742d93f2c3d1fde6fc2
MD5 48932d1e50b365478293ac654d38a2e8
SHA1 9dab267e1aaa315dff94ec286a5b1c0a589d0afb
SHA512 fdfa59c449a22c6d4cf8d51acc1664543b9eed1003ec2d0c9afba763febe82390562b0c5bfbbc57d25915f319d959201a29549e849e19620e1f8436952befa3e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b8558148e3e83f10332dd115f620a34fa32a6f646ff1088b14c55778676c72f9
MD5 ac677c836bb1be01f164aa6b42bceabf
SHA1 5d0c7e59bfc3497a0d089e37c05ccb3f50191818
SHA512 7ee2383d781e9ec5b22e57074bbd16f9571b4bbf5bf31cd11590a08f6e37e08462338151fe9dade5360577935abeb51a0c2f9ab3d007156efbdbc98e56d43e42
SSDEEP 768:mFiE6esE8lDldUGW3/CgNKO8hGwbdwevnJU0KJrZovGqsW7iIKu8CE1Jl4L:veB85dO3kg2juZWGeiAtE1O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 cf5d4cd885cb3cdaa66e32020b6fa081d603274ace17a6b25354088573e4427e
MD5 27e52b0de312123d3a9e531be611845f
SHA1 6b96e34dc02dba3bcdf88f96917bf8e35f7648a4
SHA512 19abcdfcf9d3d2ed64c2496a639444a119c6d61c7d50b1b8152ba68271372dc22d1fd133efa184939c5f71d88bf5777b22e41f4bfb3436bd5d55937b963d878d
SSDEEP 768:+FiE6esE8lDldUGz3UCgUa8hGwbdwevnJU0KJrZovGqsW7iIKu8CE1x4L:neB85d737g2juZWGeiAtE14
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 74d9a23c78a753966bd81d3821d29367ee9590e254b3f3bf15fe45ba6dfb44cb
MD5 d9db0eb52ef87b5dc5155bdcb829edc7
SHA1 0e70edd17ea2d3b53bc1a88f25dc84f402800d86
SHA512 5b2554f5046a128458442853cb754e5668aff2c8179668e163e7e322f409d2550dc7bdb21fbc01405abf7195feb470150935a25675fc0ddd3d40d92c021483e3
SSDEEP 768:zFiE6esE8lDldUGz3UCgc7B8hGwbdweM9MKAO9PetovGqsW7iIKu8CE1x4L:qeB85d73xmgBMK/OWGeiAtE14
MD5 SHA1 SHA512 SSDEEP

Submit Download