1d7888d4cc9c9ca665f8393ffb0bfa1c9a5011da61d35d8d2bcda24342dbb758

Analysis

max time kernel
150s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
08/11/2025, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Test.exe
Size 78.2MB
Sample251108-bgh2faat4a
SHA256 1d7888d4cc9c9ca665f8393ffb0bfa1c9a5011da61d35d8d2bcda24342dbb758
MD5 c7bb8e629a40b50af84d8caf27236e1a
SHA1 e21072e612a45201e2d594a5ab7e7ceadc88951e
SHA512 6e9e297520f208b3eddc703801e5464df150513c36832e99a1dde4a191bcbd81e37530f13fd064891fe450a4aec7a5dd31c0991248fdd4791ca41fca1b4cb1e6
SSDEEP 1572864:h4gPXMoAEklqzfsBwcclm4zKNDENAgVPR62W9Gz3t45pP6Q4WMA/Fixj:h4Ac3PlGa/clmcKNDRG5DW9Sd4/CQ4WW
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 20 IoCs

pid	Process
1584	Test.exe
4224	Test.exe
2760	Test.exe
5672	Test.exe
812	Test.exe
976	Test.exe
3788	Test.exe
6636	Test.exe
1044	Test.exe
5696	decryptor.exe
4932	Test.exe
492	Test.exe
6632	Test.exe
3960	Test.exe
6128	Test.exe
2876	Test.exe
5076	Test.exe
2824	Test.exe
5616	Test.exe
7712	Test.exe

Loads dropped DLL 63 IoCs

pid	Process
5704	Test.exe
5704	Test.exe
5704	Test.exe
1584	Test.exe
1584	Test.exe
1584	Test.exe
4224	Test.exe
2760	Test.exe
4224	Test.exe
4224	Test.exe
4224	Test.exe
4224	Test.exe
5672	Test.exe
5672	Test.exe
5672	Test.exe
812	Test.exe
976	Test.exe
812	Test.exe
812	Test.exe
812	Test.exe
812	Test.exe
3788	Test.exe
3788	Test.exe
6636	Test.exe
1044	Test.exe
6636	Test.exe
1044	Test.exe
1584	Test.exe
3788	Test.exe
6636	Test.exe
1044	Test.exe
6636	Test.exe
4932	Test.exe
1044	Test.exe
492	Test.exe
3788	Test.exe
6632	Test.exe
4932	Test.exe
6632	Test.exe
4932	Test.exe
6632	Test.exe
3960	Test.exe
6128	Test.exe
2876	Test.exe
3960	Test.exe
3960	Test.exe
3960	Test.exe
3960	Test.exe
5076	Test.exe
2876	Test.exe
2876	Test.exe
2876	Test.exe
2876	Test.exe
492	Test.exe
492	Test.exe
2824	Test.exe
5616	Test.exe
2824	Test.exe
2824	Test.exe
2824	Test.exe
2824	Test.exe
7712	Test.exe
7712	Test.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Test = "C:\\Users\\Admin\\AppData\\Local\\Temp\\34ypVHnXE6EC7EeZ1PaVJXvnZLw\\Test.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_Health_Courtage_vuenk9 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\Test.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows_Health_Courtage_vuenk9 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\Test.exe"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 45 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3476	powershell.exe
5024	powershell.exe
5908	powershell.exe
4216	powershell.exe
4840	powershell.exe
652	powershell.exe
6168	powershell.exe
5952	powershell.exe
1872	powershell.exe
6344	powershell.exe
4340	powershell.exe
2320	powershell.exe
4216	powershell.exe
4200	powershell.exe
5700	powershell.exe
1600	powershell.exe
812	powershell.exe
492	powershell.exe
4384	powershell.exe
3548	powershell.exe
1912	powershell.exe
7160	powershell.exe
6984	powershell.exe
7880	powershell.exe
4012	powershell.exe
2260	powershell.exe
3584	powershell.exe
4348	powershell.exe
6692	powershell.exe
7032	powershell.exe
3972	powershell.exe
1056	powershell.exe
2472	powershell.exe
3808	powershell.exe
1544	powershell.exe
900	powershell.exe
7028	powershell.exe
7024	powershell.exe
6404	powershell.exe
5132	powershell.exe
1988	powershell.exe
3472	powershell.exe
6052	powershell.exe
3724	powershell.exe
4396	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
12	api.gofile.io
46	raw.githubusercontent.com
67	raw.githubusercontent.com
138	api.gofile.io
1	raw.githubusercontent.com
16	raw.githubusercontent.com
40	raw.githubusercontent.com
65	raw.githubusercontent.com
66	raw.githubusercontent.com

Looks up external IP address via web service 30 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ipinfo.io
28	ipinfo.io
51	ipinfo.io
24	ipinfo.io
59	ipinfo.io
12	ipinfo.io
22	ipinfo.io
54	ipinfo.io
29	ipinfo.io
4	ipinfo.io
6	ipinfo.io
53	ipinfo.io
56	ipinfo.io
3	ipinfo.io
5	ipinfo.io
37	ipinfo.io
57	ipinfo.io
1	ipinfo.io
27	ipinfo.io
36	ipinfo.io
41	ipinfo.io
49	ipinfo.io
52	ipinfo.io
60	ipinfo.io
23	ipinfo.io
35	ipinfo.io
38	ipinfo.io
50	ipinfo.io
58	ipinfo.io
61	ipinfo.io

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Windows.Storage.pdb	Test.exe
File opened for modification	C:\Windows\System32\mscms.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\msvcrt.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\DLL\dhcpcsvc.pdb	Test.exe
File opened for modification	C:\Windows\System32\gdi32.pdb	Test.exe
File opened for modification	C:\Windows\System32\advapi32.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\nsi.pdb	Test.exe
File opened for modification	C:\Windows\System32\rsaenh.pdb	Test.exe
File opened for modification	C:\Windows\System32\exe\electron.exe.pdb	Test.exe
File opened for modification	C:\Windows\System32\DLL\kernel32.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\userenv.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\powrprof.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\advapi32.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\node\dpapi.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\NapiNSP.pdb	Test.exe
File opened for modification	C:\Windows\System32\gpapi.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\userenv.pdb	Test.exe
File opened for modification	C:\Windows\System32\DLL\imm32.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\mswsock.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\winrnr.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\comctl32.pdb	Test.exe
File opened for modification	C:\Windows\System32\profapi.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\mscms.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\mscms.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\winmm.pdb	Test.exe
File opened for modification	C:\Windows\System32\DLL\iphlpapi.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\winhttp.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32.pdb	Test.exe
File opened for modification	C:\Windows\System32\shell32.pdb	Test.exe
File opened for modification	C:\Windows\System32\nsi.pdb	Test.exe
File opened for modification	C:\Windows\System32\dhcpcsvc6.pdb	Test.exe
File opened for modification	C:\Windows\System32\ffmpeg.dll.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\MMDevAPI.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\DLL\kernel32.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\dbghelp.pdb	Test.exe
File opened for modification	C:\Windows\System32\sspicli.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\UMPDC.pdb	Test.exe
File opened for modification	C:\Windows\System32\imm32.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\DLL\imm32.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\dnsapi.pdb	Test.exe
File opened for modification	C:\Windows\System32\winsta.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\exe\electron.exe.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\ffmpeg.dll.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\version.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\bcryptprimitives.pdb	Test.exe
File opened for modification	C:\Windows\System32\gdi32full.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\dpapi.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\wtsapi32.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\winsta.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\version.pdb	Test.exe
File opened for modification	C:\Windows\System32\DLL\dhcpcsvc.pdb	Test.exe
File opened for modification	C:\Windows\System32\user32.pdb	Test.exe
File opened for modification	C:\Windows\System32\specs_window.pdb	Test.exe
File opened for modification	C:\Windows\System32\dpapi.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\nlansp_c.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\msasn1.pdb	Test.exe
File opened for modification	C:\Windows\System32\cryptsp.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\kernelbase.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\DLL\sspicli.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\dll\uxtheme.pdb	Test.exe
File opened for modification	C:\Windows\System32\dll\shcore.pdb	Test.exe
File opened for modification	C:\Windows\System32\msctf.pdb	Test.exe
File opened for modification	C:\Windows\System32\symbols\DLL\dhcpcsvc6.pdb	Test.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
6816	tasklist.exe
4652	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
6700	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Test.exe

Checks processor information in registry 2 TTPs 35 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Test.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Test.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Test.exe

Detects videocard installed 1 TTPs 7 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3120	WMIC.exe
2800	WMIC.exe
5264	WMIC.exe
1500	WMIC.exe
4228	WMIC.exe
4932	WMIC.exe
2188	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 16 IoCs

defense_evasion

pid	Process
1544	taskkill.exe
5596	taskkill.exe
2388	taskkill.exe
236	taskkill.exe
6304	taskkill.exe
1192	taskkill.exe
5996	taskkill.exe
6192	taskkill.exe
3452	taskkill.exe
7552	taskkill.exe
1748	taskkill.exe
5024	taskkill.exe
1900	taskkill.exe
5424	taskkill.exe
7012	taskkill.exe
5968	taskkill.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Edge_cookies.txt:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Local\Temp\0bca1e6a-ce75-4d4d-8e76-709143ed8435\fallback-cookies\Edge_cookies.txt\:Zone.Identifier:$DATA	Test.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1584	Test.exe
1584	Test.exe
1584	Test.exe
1584	Test.exe
3476	powershell.exe
3476	powershell.exe
3584	powershell.exe
3584	powershell.exe
3660	powershell.exe
3660	powershell.exe
5028	powershell.exe
5028	powershell.exe
2472	powershell.exe
2472	powershell.exe
3476	powershell.exe
3476	powershell.exe
4348	powershell.exe
4348	powershell.exe
3808	powershell.exe
3808	powershell.exe
492	powershell.exe
492	powershell.exe
3584	powershell.exe
3584	powershell.exe
4348	powershell.exe
5028	powershell.exe
3660	powershell.exe
2472	powershell.exe
3808	powershell.exe
492	powershell.exe
1584	Test.exe
1584	Test.exe
1584	Test.exe
1584	Test.exe
1584	Test.exe
3724	powershell.exe
3724	powershell.exe
5672	Test.exe
5672	Test.exe
5672	Test.exe
5672	Test.exe
4340	powershell.exe
4340	powershell.exe
3476	powershell.exe
3476	powershell.exe
1600	powershell.exe
1600	powershell.exe
4396	powershell.exe
4396	powershell.exe
5908	powershell.exe
5908	powershell.exe
4556	powershell.exe
4556	powershell.exe
3472	powershell.exe
3472	powershell.exe
5024	powershell.exe
5024	powershell.exe
4384	powershell.exe
4384	powershell.exe
5952	powershell.exe
5952	powershell.exe
1544	powershell.exe
1544	powershell.exe
5232	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5704	Test.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeIncreaseQuotaPrivilege	5108	WMIC.exe
Token: SeSecurityPrivilege	5108	WMIC.exe
Token: SeTakeOwnershipPrivilege	5108	WMIC.exe
Token: SeLoadDriverPrivilege	5108	WMIC.exe
Token: SeSystemProfilePrivilege	5108	WMIC.exe
Token: SeSystemtimePrivilege	5108	WMIC.exe
Token: SeProfSingleProcessPrivilege	5108	WMIC.exe
Token: SeIncBasePriorityPrivilege	5108	WMIC.exe
Token: SeCreatePagefilePrivilege	5108	WMIC.exe
Token: SeBackupPrivilege	5108	WMIC.exe
Token: SeRestorePrivilege	5108	WMIC.exe
Token: SeShutdownPrivilege	5108	WMIC.exe
Token: SeDebugPrivilege	5108	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5108	WMIC.exe
Token: SeRemoteShutdownPrivilege	5108	WMIC.exe
Token: SeUndockPrivilege	5108	WMIC.exe
Token: SeManageVolumePrivilege	5108	WMIC.exe
Token: 33	5108	WMIC.exe
Token: 34	5108	WMIC.exe
Token: 35	5108	WMIC.exe
Token: 36	5108	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4228	WMIC.exe
Token: SeSecurityPrivilege	4228	WMIC.exe
Token: SeTakeOwnershipPrivilege	4228	WMIC.exe
Token: SeLoadDriverPrivilege	4228	WMIC.exe
Token: SeSystemProfilePrivilege	4228	WMIC.exe
Token: SeSystemtimePrivilege	4228	WMIC.exe
Token: SeProfSingleProcessPrivilege	4228	WMIC.exe
Token: SeIncBasePriorityPrivilege	4228	WMIC.exe
Token: SeCreatePagefilePrivilege	4228	WMIC.exe
Token: SeBackupPrivilege	4228	WMIC.exe
Token: SeRestorePrivilege	4228	WMIC.exe
Token: SeShutdownPrivilege	4228	WMIC.exe
Token: SeDebugPrivilege	4228	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4228	WMIC.exe
Token: SeRemoteShutdownPrivilege	4228	WMIC.exe
Token: SeUndockPrivilege	4228	WMIC.exe
Token: SeManageVolumePrivilege	4228	WMIC.exe
Token: 33	4228	WMIC.exe
Token: 34	4228	WMIC.exe
Token: 35	4228	WMIC.exe
Token: 36	4228	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5084	WMIC.exe
Token: SeSecurityPrivilege	5084	WMIC.exe
Token: SeTakeOwnershipPrivilege	5084	WMIC.exe
Token: SeLoadDriverPrivilege	5084	WMIC.exe
Token: SeSystemProfilePrivilege	5084	WMIC.exe
Token: SeSystemtimePrivilege	5084	WMIC.exe
Token: SeProfSingleProcessPrivilege	5084	WMIC.exe
Token: SeIncBasePriorityPrivilege	5084	WMIC.exe
Token: SeCreatePagefilePrivilege	5084	WMIC.exe
Token: SeBackupPrivilege	5084	WMIC.exe
Token: SeRestorePrivilege	5084	WMIC.exe
Token: SeShutdownPrivilege	5084	WMIC.exe
Token: SeDebugPrivilege	5084	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5084	WMIC.exe
Token: SeRemoteShutdownPrivilege	5084	WMIC.exe
Token: SeUndockPrivilege	5084	WMIC.exe
Token: SeManageVolumePrivilege	5084	WMIC.exe
Token: 33	5084	WMIC.exe
Token: 34	5084	WMIC.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5704 wrote to memory of 1584	5704	Test.exe	79
PID 5704 wrote to memory of 1584	5704	Test.exe	79
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 4224	1584	Test.exe	81
PID 1584 wrote to memory of 2760	1584	Test.exe	82
PID 1584 wrote to memory of 2760	1584	Test.exe	82
PID 1584 wrote to memory of 952	1584	Test.exe	83
PID 1584 wrote to memory of 952	1584	Test.exe	83
PID 1584 wrote to memory of 1648	1584	Test.exe	84
PID 1584 wrote to memory of 1648	1584	Test.exe	84
PID 952 wrote to memory of 3476	952	cmd.exe	87
PID 952 wrote to memory of 3476	952	cmd.exe	87
PID 1648 wrote to memory of 3584	1648	cmd.exe	88
PID 1648 wrote to memory of 3584	1648	cmd.exe	88
PID 1584 wrote to memory of 2764	1584	Test.exe	89
PID 1584 wrote to memory of 2764	1584	Test.exe	89
PID 1584 wrote to memory of 2484	1584	Test.exe	90
PID 1584 wrote to memory of 2484	1584	Test.exe	90
PID 1584 wrote to memory of 5252	1584	Test.exe	91
PID 1584 wrote to memory of 5252	1584	Test.exe	91
PID 1584 wrote to memory of 5192	1584	Test.exe	92
PID 1584 wrote to memory of 5192	1584	Test.exe	92
PID 1584 wrote to memory of 2744	1584	Test.exe	93
PID 1584 wrote to memory of 2744	1584	Test.exe	93
PID 1584 wrote to memory of 2988	1584	Test.exe	94
PID 1584 wrote to memory of 2988	1584	Test.exe	94
PID 1584 wrote to memory of 2980	1584	Test.exe	95
PID 1584 wrote to memory of 2980	1584	Test.exe	95
PID 1584 wrote to memory of 3152	1584	Test.exe	103
PID 1584 wrote to memory of 3152	1584	Test.exe	103
PID 1584 wrote to memory of 4628	1584	Test.exe	104
PID 1584 wrote to memory of 4628	1584	Test.exe	104
PID 2764 wrote to memory of 5108	2764	cmd.exe	107
PID 2764 wrote to memory of 5108	2764	cmd.exe	107
PID 2764 wrote to memory of 3380	2764	cmd.exe	108
PID 2764 wrote to memory of 3380	2764	cmd.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Test.exe
"C:\Users\Admin\AppData\Local\Temp\Test.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5704
- C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
  C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
    "C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1860 --field-trial-handle=1864,i,10789729816613890208,7324963201610995602,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4224
- - C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
    "C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --mojo-platform-channel-handle=2376 --field-trial-handle=1864,i,10789729816613890208,7324963201610995602,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5108
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:2484
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5084
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:1244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:5252
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious use of AdjustPrivilegeToken
      PID:4228
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:4496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:5192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:2744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
    3⤵
    PID:2988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
    3⤵
    PID:2980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
    3⤵
    PID:3152
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
    3⤵
    PID:4628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test""
    3⤵
    PID:3452
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test"
      4⤵
      PID:2348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Test /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe" /f"
    3⤵
    PID:2124
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Test /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe" /f
      4⤵
      Adds Run key to start application
      PID:1040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Windows_Health_Courtage_vuenk9 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe" /f"
    3⤵
    PID:5540
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Windows_Health_Courtage_vuenk9 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe" /f
      4⤵
      Adds Run key to start application
      PID:904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Windows_Health_Courtage_vuenk9 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe" /f"
    3⤵
    PID:420
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v Windows_Health_Courtage_vuenk9 /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe" /f
      4⤵
      Adds Run key to start application
      PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "try { $Action = New-ScheduledTaskAction -Execute "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Test.exe"; $Trigger = New-ScheduledTaskTrigger -Daily -At "12:00PM"; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable; Register-ScheduledTask -Action $Action -Trigger $Trigger -Settings $Settings -TaskName "DailySystemUpdate_o5eq9v" -Force -User $env:USERNAME; Write-Host "TASK_CREATED_SUCCESS" } catch { Write-Host "TASK_CREATED_ERROR: $($_.Exception.Message)" }""
    3⤵
    PID:2404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "try { $Action = New-ScheduledTaskAction -Execute "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Test.exe"; $Trigger = New-ScheduledTaskTrigger -Daily -At "12:00PM"; $Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable; Register-ScheduledTask -Action $Action -Trigger $Trigger -Settings $Settings -TaskName "DailySystemUpdate_o5eq9v" -Force -User $env:USERNAME; Write-Host "TASK_CREATED_SUCCESS" } catch { Write-Host "TASK_CREATED_ERROR: $($_.Exception.Message)" }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupkix4g /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe\" /F /rl highest"
    3⤵
    PID:1120
  - - C:\Windows\system32\cmd.exe
      cmd /c schtasks /create /sc onlogon /tn WindowsDriverSetupkix4g /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe\" /F /rl highest
      4⤵
      PID:944
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /sc onlogon /tn WindowsDriverSetupkix4g /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe\" /F /rl highest
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-ItemProperty -Path \"HKCU:\SOFTWARE\Valve\Steam\" -Name \"SteamPath\" | Select-Object -ExpandProperty SteamPath"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
    3⤵
    PID:4716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
    3⤵
    PID:5528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:2384
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      PID:1744
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:2988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:4928
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:3968
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:3892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:5884
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:4932
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:5940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:1692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:5136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
    3⤵
    PID:652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
    3⤵
    PID:3404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
    3⤵
    PID:2108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
    3⤵
    PID:2372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
    3⤵
    PID:5960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
    3⤵
    PID:2384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:6580
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      PID:2388
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:1384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:1192
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:6472
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:6572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:788
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:3120
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:6488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:2196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:2156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      PID:6276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
    3⤵
    PID:4880
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
    3⤵
    PID:6120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
    3⤵
    PID:1888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
    3⤵
    PID:4760
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:8
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-ScheduledTask -TaskName 'DailySystemUpdate_o5eq9v' -ErrorAction SilentlyContinue | Select-Object TaskName, State""
    3⤵
    PID:6340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-ScheduledTask -TaskName 'DailySystemUpdate_o5eq9v' -ErrorAction SilentlyContinue | Select-Object TaskName, State"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      PID:6700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    PID:1716
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:1748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
    3⤵
    PID:2072
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3472
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM msedge.exe
      4⤵
      Kills process with taskkill
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
    3⤵
    PID:4920
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM brave.exe
      4⤵
      Kills process with taskkill
      PID:5024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
    3⤵
    PID:2904
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM firefox.exe
      4⤵
      Kills process with taskkill
      PID:1192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
    3⤵
    PID:5508
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM opera.exe
      4⤵
      Kills process with taskkill
      PID:5968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe"
    3⤵
    PID:6424
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM kometa.exe
      4⤵
      Kills process with taskkill
      PID:5596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe"
    3⤵
    PID:6892
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM orbitum.exe
      4⤵
      Kills process with taskkill
      PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe"
    3⤵
    PID:6844
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM centbrowser.exe
      4⤵
      Kills process with taskkill
      PID:1900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM 7star.exe"
    3⤵
    PID:6732
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM 7star.exe
      4⤵
      Kills process with taskkill
      PID:236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM sputnik.exe"
    3⤵
    PID:6820
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM sputnik.exe
      4⤵
      Kills process with taskkill
      PID:6304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe"
    3⤵
    PID:1360
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:5996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epicprivacybrowser.exe"
    3⤵
    PID:4684
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM epicprivacybrowser.exe
      4⤵
      Kills process with taskkill
      PID:6192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe"
    3⤵
    PID:5504
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM uran.exe
      4⤵
      Kills process with taskkill
      PID:5424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe"
    3⤵
    PID:3364
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM yandex.exe
      4⤵
      Kills process with taskkill
      PID:3452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe"
    3⤵
    PID:4712
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM iridium.exe
      4⤵
      Kills process with taskkill
      PID:7012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:5872
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4556
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:6368
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:4652
- - C:\Users\Admin\AppData\Local\Temp\decryptor_0851035b-da02-41eb-b6e1-4201c6cfbb0a\decryptor.exe
    C:\Users\Admin\AppData\Local\Temp\decryptor_0851035b-da02-41eb-b6e1-4201c6cfbb0a\decryptor.exe
    3⤵
    - Executes dropped EXE
    PID:5696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\decryptor_0851035b-da02-41eb-b6e1-4201c6cfbb0a\temp_browser_data\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\decryptor_0851035b-da02-41eb-b6e1-4201c6cfbb0a\output.zip' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "--load-extension=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Edge" "--disable-extensions-except=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Edge" --disable-popup-blocking --no-first-run --no-default-browser-check --disable-session-crashed-bubble --window-size=800,600 --window-position=-32000,-32000
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffc7f70f208,0x7ffc7f70f214,0x7ffc7f70f220
      4⤵
      PID:6352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1932,i,14049442223175930398,15015586894151165695,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2228,i,14049442223175930398,15015586894151165695,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
      4⤵
      PID:7212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1868,i,14049442223175930398,15015586894151165695,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:13
      4⤵
      PID:7620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3552,i,14049442223175930398,15015586894151165695,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3572,i,14049442223175930398,15015586894151165695,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4780,i,14049442223175930398,15015586894151165695,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5044,i,14049442223175930398,15015586894151165695,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5328,i,14049442223175930398,15015586894151165695,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=5408,i,14049442223175930398,15015586894151165695,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
      4⤵
      PID:7276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5684,i,14049442223175930398,15015586894151165695,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
      4⤵
      NTFS ADS
      PID:7824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
    3⤵
    PID:8164
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:7552
- - C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
    "C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2744 --field-trial-handle=1864,i,10789729816613890208,7324963201610995602,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:7712

C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:5672
- C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
  "C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2220 --field-trial-handle=2224,i,8059807305747355332,6290296452100420547,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:812
- C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
  "C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --mojo-platform-channel-handle=2412 --field-trial-handle=2224,i,8059807305747355332,6290296452100420547,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
  2⤵
  PID:5728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
  2⤵
  PID:3648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
  2⤵
  PID:8
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic OS get caption, osarchitecture
    3⤵
    PID:3716
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
  2⤵
  PID:2368
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:4924
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:1480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
  2⤵
  PID:1064
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:2188
- - C:\Windows\system32\more.com
    more +1
    3⤵
    PID:4588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
  2⤵
  PID:5608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
  2⤵
  PID:4116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
  2⤵
  PID:4888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
  2⤵
  PID:4044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
  2⤵
  PID:2976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
  2⤵
  PID:3460
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test""
  2⤵
  PID:2288
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test"
    3⤵
    PID:3324

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3788
- C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
  C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:6632
- - C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
    "C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2176 --field-trial-handle=2180,i,7014459780311971076,14484015509339388340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2876
- - C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
    "C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --mojo-platform-channel-handle=2268 --field-trial-handle=2180,i,7014459780311971076,14484015509339388340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
    3⤵
    PID:1028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
    3⤵
    PID:2456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:3376
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      PID:1912
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:6136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:3968
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1480
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:6048
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:3168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:6872
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:5264
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:6032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:3716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:6896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      PID:5960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
    3⤵
    PID:6788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
    3⤵
    PID:6520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
    3⤵
    PID:3896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
    3⤵
    PID:4456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test""
    3⤵
    PID:8024
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5032
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test"
      4⤵
      PID:3640

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1044
- C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
  C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:492
- - C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
    "C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1892 --field-trial-handle=1896,i,18343312838707386585,13946235834565594326,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2824
- - C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
    "C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --mojo-platform-channel-handle=1992 --field-trial-handle=1896,i,18343312838707386585,13946235834565594326,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
    3⤵
    PID:1296
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
    3⤵
    PID:1900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:6528
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      PID:6516
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:6124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:6868
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:6276
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:7388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:3360
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:1500
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:6664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:7276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:5884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      PID:5332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
    3⤵
    PID:6948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
    3⤵
    PID:5804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
    3⤵
    PID:772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
    3⤵
    PID:5912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test""
    3⤵
    PID:8108
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1500
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test"
      4⤵
      PID:2976

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Test.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6636
- C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
  C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:4932
- - C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
    "C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2188 --field-trial-handle=2192,i,3683064098704460666,17889619443426608291,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3960
- - C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe
    "C:\Users\Admin\AppData\Local\Temp\34ypVHnXE6EC7EeZ1PaVJXvnZLw\Test.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\resignaciones" --mojo-platform-channel-handle=2372 --field-trial-handle=2192,i,3683064098704460666,17889619443426608291,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json""
    3⤵
    PID:7164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "Get-PSDrive -Name C | Select-Object Used, Free | ConvertTo-Json"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
    3⤵
    PID:4724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic OS get caption, osarchitecture | more +1"
    3⤵
    PID:3648
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic OS get caption, osarchitecture
      4⤵
      PID:6668
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:3728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get name | more +1"
    3⤵
    PID:5032
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:3120
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:6908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic PATH Win32_VideoController get name | more +1"
    3⤵
    PID:2256
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2800
  - - C:\Windows\system32\more.com
      more +1
      4⤵
      PID:7008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    PID:4912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName"
    3⤵
    PID:4992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion' -Name ProductName
      4⤵
      PID:5024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model""
    3⤵
    PID:708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_ComputerSystem).Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name""
    3⤵
    PID:692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' } | Select-Object -ExpandProperty Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product""
    3⤵
    PID:2744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion""
    3⤵
    PID:3592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Get-CimInstance -Class Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test""
    3⤵
    PID:5096
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2072
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Test"
      4⤵
      PID:8020

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:6700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\af6c4912063bf4c9\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 6c7faefa8e7e636ab74cb82c38fac8b3b79c7b349188644d1a500c90e835f29f
MD5 8a783d2b16c65427fc134207941a7f5c
SHA1 902175692ae6c2ed5789662aafbe8beb37813f55
SHA512 cfb397107f0c0603403149406cfb61b6a8693f36ef8021be8eb948d72f51cdea293379a5d3d80a42942b29756393e5045b986b492f3ecbf9dfd93a6d9f5d7401
SSDEEP 3:paD9/lGlll/l/lXp9ZjrPBY0Ol95KrtDP:60dPBY0OUh
MD5 SHA1 SHA512 SSDEEP

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\af6c4912063bf4c9\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\af6c4912063bf4c9\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 1KB
SHA256 238a7394b491c0f90489f6532ca842e36e973a7723656030e14858135f838844
MD5 892bb097149ade10d7e56415c6fc883a
SHA1 facb2b13350351cdff73253de0a192769712402b
SHA512 913aa67328843a60a0e2306acc1cc416431d9b7309ffb00378d8415a59c845c644862b9053a28a89334c34e7415859e25338e64a6e9e36aef0d97b531a335dea
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 f51b54c5f5074076216b2d0a3e66c13e80d8f1da311614ec15c9170dff11ad5a
MD5 05850c6c0442ea6966fe2a888f219f4b
SHA1 e6b1c8eb783b307672a6f06b785a7e9b78633b46
SHA512 9db20e00e103700f67256568e38f9b37f29af3c30f3454a38b3e033c6c2f6bd796c5b5a8c5faa98bb45d7521d76c2bf323d503b8a0196cacbd701167d441c6f9
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 21ddfb155455e1b2bd1e291250ea47e49ffa970172e8ad0bb0eb9e1724cfd0a5
MD5 41e61c453b8182f1c16003e05e93feb3
SHA1 224dee6a422a7559c312cda15f7ecd2899f52d27
SHA512 5256aac6545bcd432d9c38facd8da427ba442bb3e2d6762a33a63ee77e49b50a43f19ef57540ba2b4e677e905febac6afc18ce5657bfacef7599b84d22dbba34
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 e9b197c1512e0abb59a769052f60fc2df7b9507c4268b27831cab067d5f38785
MD5 9d44d7ab0c8e840b34a192872ea6ecbd
SHA1 de7f507633184e1a21e2c637052d4b596af1075e
SHA512 5a20841518496d6ff15ed5808c48d4eb94d2b9f2103a51248e317d79d38456ba4d0802c16518909acdd3ee85b9aa4e6e3f289014158c3c62a51e9288e53b7798
SSDEEP 48:5B6GJn+S60jOCSQN+KvowSepj5Hgmte2HgV2A6AWSoxJbZ8Ru5CFG2EXQlpk:aG0S60jj1voelgmpyYbZx0BEXwk
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index~RFe59cf0e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cf0e.TMP
Size 3KB
SHA256 0af4a27ce7945c2bba9c87cf6b39495e5a3efd73ddd909b5d64f14e4707e9cf3
MD5 71e7a0e8efaff67e9697e43e90c67994
SHA1 16f1fd054504515e8ec59b7f37e349c582743957
SHA512 509e82805311512a0584123101653acb2058a16f8ef6c3d5882d06ef7f6a85bc359f2281bf693f6993359c5cd05d82147c8dfba7668874dfb790a103059be074
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ad683a35d1c2857744ecb83e1b1ec14c5b8ef3d50e60d898d80e70720081689e
MD5 744602fc5d8bcc3e1328d3f4adf8f74e
SHA1 ff299bbbd8f30d7cea77a1c33b6b0fc20b597f77
SHA512 4fae7e1d6837cb444f25d57e689e5a94d50e3fc4863749b91e94cb61e838c785960460545ceb1aee085694ac0a5030e97865335aa553bb4f9b91189c20443e58
SSDEEP 192:sVPR7yMqv/K1Ml8MJMRs1f569S5w0y7n7rzJZ8plQ/Y+WNnNSwY0z+DvPyVx4ndO:sVPW+Rsl56Mi/SAw50CT4nnAd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 a2849957e8dbb428461462d1af72eb349dc27791b799622abdbc3690dbe65609
MD5 ecf47fda191aec5aa892c2222ef86345
SHA1 f9119d4099322524e458a64da8d178e1b7cc9d23
SHA512 154c97f1723e2a2b94ffdc52261ac3268d923481fa330b3b3cf0af0dddf417587850fc8f3e5b0052fa721d38810e52d2c014e923f80b287d9af34e838d276b65
SSDEEP 768:OnHyZ8Yt2SMWRW40Q8o8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KLLl/qE0bkECFrI:OnHyZ8Yt2SMWRW40Q8ou1jaKKLLpqlbd
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1010a76c-0a7e-4563-a751-6ac53cbbd8cc\index-dir\the-real-index
Size 2KB
SHA256 263670a5638c6a198e79de95e0a701d8212d1f7a2e9a885f60627460f63120b2
MD5 df0f9856cb6cb34e7c41831ed555cfb0
SHA1 7e02e5cab1a55f32f7211fa22a108d8398cee49f
SHA512 050f671b9889bb3835943892dc26a1f0e18ae2291e198c89aafa1b8c7703ac9c6ee3f832b2c31ef62b3ecc448107865ae55c44401849ebcc171a4c41e75ba86f
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe597c0c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1010a76c-0a7e-4563-a751-6ac53cbbd8cc\index-dir\the-real-index~RFe597c0c.TMP
Size 2KB
SHA256 f7d01c8efc16ce200068243380a6c9caaad75c6f38a248c59f18b9eca363262c
MD5 457796bbd9fa0b3ebabceb27ca55112b
SHA1 72bcdf6c65b10f80f064909813da11abe70cb8b7
SHA512 fae087cc67b7113b2b8a27f37ed53167e4a723bf1c4c2cff5601366cbbf74fe91e486c485c0fd826a7aad32921d15dcd467b824a180fcda93deaed012447bde6
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 253B
SHA256 8c7c3bc81c96cb038ac631240d1436df2b02f71d39337f8a1c7425a6670aa755
MD5 72b7b12b34f3d295c9a1a414f3947254
SHA1 945ce8dfd85f16f0d265ee10a49cc67170cb6ad4
SHA512 0c47334e215c44c112b937eb6f5f461f73d5be5ba6277e0b4b9ec3de9dfd34c0568dbbc6e09c5f9ad066636dbcdd923cd2dbc62d22986d820a7087dd87213c2a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 81d68ebb4ba8ba4e4d4b980c8dcdfbb8dd55cd65d3d4e95bc40f5dfa03d63b4f
MD5 7d7d65e008cf6af07de522a079f01aa8
SHA1 b6ba6954a3cd37f4640e89e348548f7d3fa40415
SHA512 f39eab4facb1469208bea41613807a2f659d41af40dd520399d3f703f530482dda19e673f470b2034daa2636378508223522d5da01ad8b027671d5f7fd0221a6
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe59c431.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59c431.TMP
Size 72B
SHA256 b5ab401e4882c36063b529fc8862601b4d6af7c4e5b0c9da5349b299d996ccdd
MD5 201808b7b773dbd0b4bda253b0e6fa07
SHA1 c8693b74fffde95f00b556e4f41a114dee6002dc
SHA512 10de94b017db1442bb43a80243293854468d15c22ca6542c8be129eed6db3518ecfcfa008440e64f837c24220abb2dbabf0c51e2f624ea469910cb6f77315998
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 671ae1b6cc516896993b7e45a501d1a51160383379549b6b37c5e5b2e63e6add
MD5 93bd357fcc721ae9fb1a6d494404464c
SHA1 6de1252d2ecf2e64890053fe54dd9eec67d7d402
SHA512 91457fd565294a8be275111c9e941ec2074db15dd9b3cd0f815dd3bb5f3834d5760d23f7f8820685e0ca287bae7bd6bd705da4503c30ea7fd61496791b18ed80
SSDEEP 768:WF5BLv7I5wCPFdV6Ziu3/Cg96AwWpZl8EgBcXs9focjjAp:eJUV6Zf3MH8MNjjw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 6e92bfeded9f4418ae290542de78f96391c3b085ba7c2f7ba998a4efffafd442
MD5 f7591a050c0bcfe6425ef2c0f3efbf98
SHA1 4d5c268f2a5db80b6981c6c850725a27c1fbdba2
SHA512 7e3ef1216012a159b76f86da2c1753420787150e3a625a8dca05fc8bdbe1e457aa7c8ab1329e442998ec310c586389878022b26204e3de38ee76b7eeca1449a0
SSDEEP 768:XF5BLv7I5wCPFdV6Zi63UCgbAwBvfl8EgBx1KfM9Ge3ocjja:PJUV6ZL3cBezKxcjja
MD5 SHA1 SHA512 SSDEEP

Submit Download