69b06922d1b8341bb0909ae83010e4e5c934a1c9f92ffe8d57f34153c0010ff8

user interaction
yes
max time kernel
900s
max time network
901s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 13:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BulkFileChanger.exe
Size 130KB
Sample260525-q8m7ssh19n
SHA256 69b06922d1b8341bb0909ae83010e4e5c934a1c9f92ffe8d57f34153c0010ff8
MD5 2dfa351e02f71650ce635970c995cc59
SHA1 ad06195853ade67cdccabc0c7ece7cf17317f7ee
SHA512 52439034ec1c21410f24755db3d84dbea1a64ecd0119478a6b3d7425bf8ad0c585390dc4e2af6463689f97dd303360849108ba0968a836c517b7ca3411dc5788
SSDEEP 3072:WFvLAdnnVYKlwMaofGPP7lzbwNZGCFG6IdSEnvrZq96S:EjKvKlz1CX
TLSH
T124D3280673F805E9E4BBD675CD324622DBB2BC684934C72F47A4D98A1F23321BD25726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
115	3816	powershell.exe
116	3816	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4892	powershell.exe
4344	powershell.exe
5360	powershell.exe
4920	powershell.exe
5232	powershell.exe
5808	powershell.exe
4944	powershell.exe
4476	powershell.exe
5968	powershell.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\tem28E9.tmp	Clipup.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Launches sc.exe 37 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1896	sc.exe
2300	sc.exe
4380	sc.exe
2300	sc.exe
4224	sc.exe
4344	sc.exe
3684	sc.exe
3232	sc.exe
2040	sc.exe
1000	sc.exe
3292	sc.exe
1880	sc.exe
3776	sc.exe
1000	sc.exe
3864	sc.exe
2144	sc.exe
1880	sc.exe
3508	sc.exe
2300	sc.exe
4356	sc.exe
1200	sc.exe
4356	sc.exe
4996	sc.exe
4532	sc.exe
3888	sc.exe
2812	sc.exe
4620	sc.exe
4680	sc.exe
4796	sc.exe
3744	sc.exe
2144	sc.exe
1880	sc.exe
3864	sc.exe
2516	sc.exe
2280	sc.exe
3232	sc.exe
2040	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2304	cmd.exe
5036	PING.EXE
2528	cmd.exe
4380	PING.EXE
3612	cmd.exe
4532	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4672	chrome.exe

Checks SCSI registry key(s) 3 TTPs 19 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	clipup.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241914473615629"	chrome.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\ExtendedProperties	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive	reg.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe

Modifies registry key 1 TTPs 57 IoCs

Modify Registry

T1112

pid	Process
8	reg.exe
2792	reg.exe
2280	reg.exe
4356	reg.exe
3292	reg.exe
8	reg.exe
2040	reg.exe
2516	reg.exe
4532	reg.exe
3232	reg.exe
4420	reg.exe
4356	reg.exe
1000	reg.exe
4216	reg.exe
2068	reg.exe
1296	reg.exe
4680	reg.exe
4620	reg.exe
4796	reg.exe
2040	reg.exe
4380	reg.exe
4216	reg.exe
1200	reg.exe
2280	reg.exe
3508	reg.exe
5912	reg.exe
5976	reg.exe
4044	reg.exe
1736	reg.exe
2040	reg.exe
5376	reg.exe
3232	reg.exe
4216	reg.exe
3684	reg.exe
3232	reg.exe
5244	reg.exe
2968	reg.exe
8	reg.exe
4532	reg.exe
3292	reg.exe
4380	reg.exe
3864	reg.exe
1836	reg.exe
4620	reg.exe
4680	reg.exe
2300	reg.exe
3292	reg.exe
3684	reg.exe
3888	reg.exe
4620	reg.exe
5012	reg.exe
4380	reg.exe
3228	reg.exe
2068	reg.exe
1200	reg.exe
3508	reg.exe
4680	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\888 Rat V1.0.8.7z:Zone.Identifier	chrome.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
4380	PING.EXE
4532	PING.EXE
5036	PING.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1064	WINWORD.EXE
1064	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2516	BulkFileChanger.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	772	taskmgr.exe
Token: SeSystemProfilePrivilege	772	taskmgr.exe
Token: SeCreateGlobalPrivilege	772	taskmgr.exe
Token: 33	772	taskmgr.exe
Token: SeIncBasePriorityPrivilege	772	taskmgr.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe
772	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2516	BulkFileChanger.exe
1064	WINWORD.EXE
1064	WINWORD.EXE
1064	WINWORD.EXE
1064	WINWORD.EXE
1064	WINWORD.EXE
1064	WINWORD.EXE
1064	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 896	5016	chrome.exe	99
PID 5016 wrote to memory of 3992	5016	chrome.exe	100
PID 5016 wrote to memory of 3992	5016	chrome.exe	100
PID 5016 wrote to memory of 4672	5016	chrome.exe	101
PID 5016 wrote to memory of 1368	5016	chrome.exe	102
PID 5016 wrote to memory of 1368	5016	chrome.exe	102
PID 5016 wrote to memory of 1940	5016	chrome.exe	103
PID 5016 wrote to memory of 3152	5016	chrome.exe	104
PID 5016 wrote to memory of 1940	5016	chrome.exe	103
PID 5016 wrote to memory of 3152	5016	chrome.exe	104
PID 5016 wrote to memory of 2852	5016	chrome.exe	105
PID 5016 wrote to memory of 2852	5016	chrome.exe	105
PID 5016 wrote to memory of 2308	5016	chrome.exe	108
PID 5016 wrote to memory of 2308	5016	chrome.exe	108
PID 5016 wrote to memory of 2772	5016	chrome.exe	109
PID 5016 wrote to memory of 4036	5016	chrome.exe	113
PID 5016 wrote to memory of 4036	5016	chrome.exe	113
PID 5016 wrote to memory of 948	5016	chrome.exe	114
PID 5016 wrote to memory of 948	5016	chrome.exe	114
PID 5016 wrote to memory of 4288	5016	chrome.exe	117
PID 5016 wrote to memory of 1296	5016	chrome.exe	118
PID 5016 wrote to memory of 488	5016	chrome.exe	119
PID 3816 wrote to memory of 4880	3816	powershell.exe	122
PID 3816 wrote to memory of 2560	3816	powershell.exe	123
PID 2560 wrote to memory of 3744	2560	cmd.exe	125
PID 2560 wrote to memory of 4680	2560	cmd.exe	126
PID 2560 wrote to memory of 996	2560	cmd.exe	127
PID 2560 wrote to memory of 936	2560	cmd.exe	128
PID 2560 wrote to memory of 2148	2560	cmd.exe	129
PID 2560 wrote to memory of 4008	2560	cmd.exe	130
PID 2560 wrote to memory of 2304	2560	cmd.exe	131
PID 2560 wrote to memory of 2924	2560	cmd.exe	132
PID 2560 wrote to memory of 4044	2560	cmd.exe	133
PID 2560 wrote to memory of 5036	2560	cmd.exe	134
PID 2560 wrote to memory of 1252	2560	cmd.exe	135
PID 1252 wrote to memory of 2792	1252	cmd.exe	136
PID 1252 wrote to memory of 1504	1252	cmd.exe	137
PID 2560 wrote to memory of 1232	2560	cmd.exe	138
PID 2560 wrote to memory of 228	2560	cmd.exe	139
PID 2560 wrote to memory of 4356	2560	cmd.exe	140
PID 2560 wrote to memory of 3428	2560	cmd.exe	141
PID 3428 wrote to memory of 3744	3428	cmd.exe	142
PID 2560 wrote to memory of 4548	2560	cmd.exe	143
PID 4548 wrote to memory of 1796	4548	cmd.exe	144
PID 2560 wrote to memory of 2968	2560	cmd.exe	145
PID 2560 wrote to memory of 5036	2560	cmd.exe	146
PID 2560 wrote to memory of 4420	2560	cmd.exe	147
PID 2560 wrote to memory of 4076	2560	cmd.exe	148
PID 2560 wrote to memory of 1000	2560	cmd.exe	149
PID 4076 wrote to memory of 4356	4076	cmd.exe	152
PID 4076 wrote to memory of 4224	4076	cmd.exe	153
PID 4076 wrote to memory of 2488	4076	cmd.exe	154
PID 4076 wrote to memory of 4688	4076	cmd.exe	155
PID 4076 wrote to memory of 4104	4076	cmd.exe	156
PID 4076 wrote to memory of 3944	4076	cmd.exe	157
PID 4076 wrote to memory of 4920	4076	cmd.exe	158
PID 4076 wrote to memory of 4620	4076	cmd.exe	159
PID 4076 wrote to memory of 3744	4076	cmd.exe	160
PID 4076 wrote to memory of 5068	4076	cmd.exe	161
PID 4076 wrote to memory of 996	4076	cmd.exe	162
PID 996 wrote to memory of 2868	996	cmd.exe	163
PID 996 wrote to memory of 3228	996	cmd.exe	164
PID 4076 wrote to memory of 4892	4076	cmd.exe	165
PID 4076 wrote to memory of 1840	4076	cmd.exe	166

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BulkFileChanger.exe
"C:\Users\Admin\AppData\Local\Temp\BulkFileChanger.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2516

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1512

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\ResumeFormat.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3300

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1036

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3976

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd34afc728,0x7ffd34afc734,0x7ffd34afc740
  2⤵
  PID:896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,6976026611108121265,10565115763775848173,262144 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1524,i,4636368469968546699,15018302451199146087,524288 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2300 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,16193916825798325641,664222731537013005,524288 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2492 /prefetch:13
  2⤵
  PID:1368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,11148769572844745497,3265399053681479438,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,12879815711465609254,4446174569295227907,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4324,i,14975394666686605960,13366676170047709240,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:9
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4684,i,16245884590778051691,9955443634509760661,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,7863112652170114901,4953909961866936314,524288 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5880,i,6067357104205703003,6746478684424476122,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3612,i,11910509959361760511,7466860236950254968,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,12567679052521293106,886422824046575400,524288 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2692 /prefetch:14
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3704,i,5042117870243104455,5891239985116952762,524288 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3708,i,13973388031875198808,9134720992121736055,524288 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5652,i,17584804298667828665,3967554933030198566,262144 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:10
  2⤵
  PID:3008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5732,i,2264056630603050586,8759324966901680121,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5964,i,10331245325491921373,14573551691750341304,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6060,i,6225219911299624439,4319804332381972883,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3528,i,2776914671783447500,11510289536083234433,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6272,i,16328973506859080516,11050041109583648615,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6160,i,1594964576021692132,2923690008505778157,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6088,i,11713134023713871942,4118315721595234431,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3556,i,4252556822811358439,3733262218762592224,524288 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3116 /prefetch:14
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6152,i,9926429013170322815,7506720240167931547,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6696,i,1934571730035212384,1444029449435509985,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6308,i,14034316915522741138,8647981002790696938,2097152 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6880,i,5158112913201984446,541170840811160349,524288 --field-trial-handle=1980,i,10428489356007727288,14921312052357194132,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6696 /prefetch:14
  2⤵
  - NTFS ADS
  PID:2036

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4956

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:3228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "echo CMD is working"
  2⤵
  PID:4880
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c ""C:\Windows\Temp\MAS_f28a3656-1f51-4b53-b965-647ab52a4c07.cmd" -el "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:3744
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:4680
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "MAS_f28a3656-1f51-4b53-b965-647ab52a4c07.cmd"
    3⤵
    PID:996
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-el" "
    3⤵
    PID:936
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:2148
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    PID:4008
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:2304
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:2924
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
    3⤵
    PID:4044
- - C:\Windows\System32\find.exe
    find /i "ARM64"
    3⤵
    PID:5036
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:2792
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:1504
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_f28a3656-1f51-4b53-b965-647ab52a4c07.cmd" "
    3⤵
    PID:1232
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:228
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:4356
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_f28a3656-1f51-4b53-b965-647ab52a4c07.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_f28a3656-1f51-4b53-b965-647ab52a4c07.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      PID:3744
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:1796
- - C:\Windows\System32\reg.exe
    reg query HKCU\Console /v QuickEdit
    3⤵
    - Modifies registry key
    PID:2968
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:5036
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:4420
- - C:\Windows\System32\cmd.exe
    cmd.exe /c ""C:\Windows\Temp\MAS_f28a3656-1f51-4b53-b965-647ab52a4c07.cmd" -el -qedit"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:4356
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:4224
  - - C:\Windows\System32\findstr.exe
      findstr /v "$" "MAS_f28a3656-1f51-4b53-b965-647ab52a4c07.cmd"
      4⤵
      PID:2488
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:4688
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:4104
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ver
      4⤵
      PID:3944
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Console" /v ForceV2
      4⤵
      PID:4920
  - - C:\Windows\System32\find.exe
      find /i "0x0"
      4⤵
      PID:4620
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
      4⤵
      PID:3744
  - - C:\Windows\System32\find.exe
      find /i "ARM64"
      4⤵
      PID:5068
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
      4⤵
      Suspicious use of WriteProcessMemory
      PID:996
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
        5⤵
        
        PID:2868
    - - C:\Windows\System32\cmd.exe
        
        cmd
        5⤵
        
        PID:3228
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_f28a3656-1f51-4b53-b965-647ab52a4c07.cmd" "
      4⤵
      PID:4892
  - - C:\Windows\System32\find.exe
      find /i "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:1840
  - - C:\Windows\System32\fltMC.exe
      fltmc
      4⤵
      PID:3056
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_f28a3656-1f51-4b53-b965-647ab52a4c07.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
      4⤵
      PID:4156
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_f28a3656-1f51-4b53-b965-647ab52a4c07.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
        5⤵
        
        PID:2156
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c mode con
      4⤵
      PID:412
    - - C:\Windows\System32\mode.com
        
        mode con
        5⤵
        
        PID:4296
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3612
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4532
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck311.activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2304
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 updatecheck311.activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5036
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:2280
  - - C:\Windows\System32\find.exe
      find /i "/S"
      4⤵
      PID:3236
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "
      4⤵
      PID:4892
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:1620
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:1232
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        5⤵
        
        PID:5012
  - - C:\Windows\System32\mode.com
      mode 76, 34
      4⤵
      PID:2796
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:3292
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:1484
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:2068
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:2752
  - - C:\Windows\System32\choice.exe
      choice /C:12345678EH0 /N
      4⤵
      PID:4868
  - - C:\Windows\System32\mode.com
      mode 110, 34
      4⤵
      PID:4008
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
      4⤵
      PID:4296
  - - C:\Windows\System32\find.exe
      find /i "AutoPico"
      4⤵
      PID:8
  - - C:\Windows\System32\find.exe
      find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:2924
  - - C:\Windows\System32\find.exe
      find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:4920
  - - C:\Windows\System32\find.exe
      find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:2704
  - - C:\Windows\System32\find.exe
      find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:1880
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:2144
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
      4⤵
      PID:3312
  - - C:\Windows\System32\findstr.exe
      findstr "577 225"
      4⤵
      PID:1992
  - - C:\Windows\System32\cmd.exe
      cmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"
      4⤵
      PID:2556
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get CreationClassName /value
        5⤵
        
        PID:1840
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:3864
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"
      4⤵
      PID:2148
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku
        5⤵
        
        PID:3292
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul
      4⤵
      PID:1860
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn
        5⤵
        
        PID:1896
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul
      4⤵
      PID:3048
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST
        5⤵
        
        PID:936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_f28a3656-1f51-4b53-b965-647ab52a4c07.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      PID:8
  - - C:\Windows\System32\find.exe
      find /i "Subscription_is_activated"
      4⤵
      PID:4620
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
      4⤵
      PID:1620
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4892
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 Pro" "
      4⤵
      PID:4020
  - - C:\Windows\System32\find.exe
      find /i "Windows"
      4⤵
      PID:4584
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:2812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"
      4⤵
      PID:3480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4944
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
      4⤵
      PID:1840
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:3008
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
      4⤵
      PID:4868
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
        5⤵
        
        PID:1296
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ver
      4⤵
      PID:4620
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2528
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 l.root-servers.net
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4380
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
      4⤵
      PID:1992
  - - C:\Windows\System32\find.exe
      find /i "AutoPico"
      4⤵
      PID:1048
  - - C:\Windows\System32\find.exe
      find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:4996
  - - C:\Windows\System32\find.exe
      find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:4532
  - - C:\Windows\System32\find.exe
      find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:2704
  - - C:\Windows\System32\find.exe
      find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:4296
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:1896
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
      4⤵
      PID:1000
  - - C:\Windows\System32\findstr.exe
      findstr "577 225"
      4⤵
      PID:3888
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:3864
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot
      4⤵
      PID:3576
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
      4⤵
      PID:3220
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
        5⤵
        
        PID:2612
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:3776
  - - C:\Windows\System32\sc.exe
      sc query ClipSVC
      4⤵
      Launches sc.exe
      PID:2144
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService
      4⤵
      Modifies registry key
      PID:3232
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description
      4⤵
      Modifies registry key
      PID:4620
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName
      4⤵
      Modifies registry key
      PID:2040
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl
      4⤵
      Modifies registry key
      PID:4380
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath
      4⤵
      Modifies registry key
      PID:4680
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName
      4⤵
      Modifies registry key
      PID:8
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start
      4⤵
      Modifies registry key
      PID:4216
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type
      4⤵
      Modifies registry key
      PID:4796
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:1880
  - - C:\Windows\System32\sc.exe
      sc query wlidsvc
      4⤵
      Launches sc.exe
      PID:3684
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService
      4⤵
      Modifies registry key
      PID:2300
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description
      4⤵
      Modifies registry key
      PID:3228
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName
      4⤵
      Modifies registry key
      PID:2792
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:3864
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath
      4⤵
      Modifies registry key
      PID:2516
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName
      4⤵
      Modifies registry key
      PID:2068
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start
      4⤵
      Modifies registry key
      PID:1836
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type
      4⤵
      Modifies registry key
      PID:1296
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:3232
  - - C:\Windows\System32\sc.exe
      sc query sppsvc
      4⤵
      Launches sc.exe
      PID:4620
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService
      4⤵
      Modifies registry key
      PID:2040
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description
      4⤵
      Modifies registry key
      PID:4380
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName
      4⤵
      Modifies registry key
      PID:4680
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:8
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath
      4⤵
      Modifies registry key
      PID:4532
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName
      4⤵
      Modifies registry key
      PID:3292
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start
      4⤵
      Modifies registry key
      PID:4216
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type
      4⤵
      Modifies registry key
      PID:3684
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:2300
  - - C:\Windows\System32\sc.exe
      sc query KeyIso
      4⤵
      Launches sc.exe
      PID:1000
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService
      4⤵
      Modifies registry key
      PID:3888
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description
      4⤵
      Modifies registry key
      PID:4044
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName
      4⤵
      Modifies registry key
      PID:1200
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl
      4⤵
      Modifies registry key
      PID:4356
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath
      4⤵
      Modifies registry key
      PID:2280
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName
      4⤵
      Modifies registry key
      PID:3508
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start
      4⤵
      Modifies registry key
      PID:3232
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type
      4⤵
      Modifies registry key
      PID:4620
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:2040
  - - C:\Windows\System32\sc.exe
      sc query LicenseManager
      4⤵
      Launches sc.exe
      PID:4380
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService
      4⤵
      Modifies registry key
      PID:4680
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description
      4⤵
      Modifies registry key
      PID:8
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName
      4⤵
      Modifies registry key
      PID:4532
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl
      4⤵
      Modifies registry key
      PID:3292
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath
      4⤵
      Modifies registry key
      PID:4216
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName
      4⤵
      Modifies registry key
      PID:3684
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start
      4⤵
      Modifies registry key
      PID:1736
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type
      4⤵
      Modifies registry key
      PID:5012
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:3864
  - - C:\Windows\System32\sc.exe
      sc query Winmgmt
      4⤵
      Launches sc.exe
      PID:2516
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService
      4⤵
      Modifies registry key
      PID:1200
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description
      4⤵
      Modifies registry key
      PID:4356
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName
      4⤵
      Modifies registry key
      PID:2280
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl
      4⤵
      Modifies registry key
      PID:3508
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath
      4⤵
      Modifies registry key
      PID:3232
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName
      4⤵
      Modifies registry key
      PID:4620
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start
      4⤵
      Modifies registry key
      PID:2040
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type
      4⤵
      Modifies registry key
      PID:4380
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:4680
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:4796
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:1880
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:2300
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:1000
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:3888
  - - C:\Windows\System32\sc.exe
      sc query ClipSVC
      4⤵
      Launches sc.exe
      PID:4224
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:3864
  - - C:\Windows\System32\sc.exe
      sc start ClipSVC
      4⤵
      Launches sc.exe
      PID:1200
  - - C:\Windows\System32\sc.exe
      sc query wlidsvc
      4⤵
      Launches sc.exe
      PID:4356
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:5068
  - - C:\Windows\System32\sc.exe
      sc start wlidsvc
      4⤵
      Launches sc.exe
      PID:3508
  - - C:\Windows\System32\sc.exe
      sc query sppsvc
      4⤵
      Launches sc.exe
      PID:3232
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:1992
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:2040
  - - C:\Windows\System32\sc.exe
      sc query KeyIso
      4⤵
      Launches sc.exe
      PID:4996
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:4920
  - - C:\Windows\System32\sc.exe
      sc start KeyIso
      4⤵
      Launches sc.exe
      PID:4532
  - - C:\Windows\System32\sc.exe
      sc query LicenseManager
      4⤵
      Launches sc.exe
      PID:3292
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:4308
  - - C:\Windows\System32\sc.exe
      sc start LicenseManager
      4⤵
      Launches sc.exe
      PID:1880
  - - C:\Windows\System32\sc.exe
      sc query Winmgmt
      4⤵
      Launches sc.exe
      PID:2300
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:1736
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:4344
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      PID:1100
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:1492
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService get Version
      4⤵
      PID:2924
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      PID:5064
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "0" "
      4⤵
      PID:3232
  - - C:\Windows\System32\findstr.exe
      findstr /i "0x800410 0x800440 0x80131501"
      4⤵
      PID:4420
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d
      4⤵
      PID:4380
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul
      4⤵
      PID:4996
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore
        5⤵
        
        PID:3436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      PID:3768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      PID:5068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4344
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
      4⤵
      PID:2040
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"
      4⤵
      PID:2868
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"
      4⤵
      PID:3856
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_f28a3656-1f51-4b53-b965-647ab52a4c07.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul
      4⤵
      PID:2488
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_f28a3656-1f51-4b53-b965-647ab52a4c07.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"
        5⤵
        
        PID:1000
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"
      4⤵
      PID:2040
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"
      4⤵
      PID:2868
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul
      4⤵
      PID:1084
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE
        5⤵
        
        PID:1048
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
      4⤵
      PID:2440
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul
      4⤵
      PID:2396
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE
        5⤵
        
        PID:4044
  - - C:\Windows\System32\sc.exe
      sc query wlms
      4⤵
      Launches sc.exe
      PID:2280
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"
      4⤵
      PID:3856
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"
      4⤵
      PID:3812
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"
      4⤵
      PID:4680
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"
      4⤵
      PID:1100
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul
      4⤵
      PID:3776
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"
        5⤵
        
        PID:1736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"
      4⤵
      PID:4344
  - - C:\Windows\System32\findstr.exe
      findstr /i "KMS_"
      4⤵
      PID:3768
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul
      4⤵
      PID:4356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"
        5⤵
        
        PID:1296
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "
      4⤵
      PID:4668
  - - C:\Windows\System32\find.exe
      find /i "Ready"
      4⤵
      PID:3872
  - - C:\Windows\System32\reg.exe
      reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f
      4⤵
      PID:3396
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"
      4⤵
      PID:2704
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "
      4⤵
      PID:2796
  - - C:\Windows\System32\findstr.exe
      findstr /i "Removed Not Found"
      4⤵
      PID:2868
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul
      4⤵
      PID:4420
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE
        5⤵
        
        PID:4512
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 0ad2ac98-7bb9-4201-8d92-312299201369 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5 221a02da-e2a1-4b75-864c-0a4410a33fdf 291ece0e-9c38-40ca-a9e1-32cc7ec19507 2936d1d2-913a-4542-b54e-ce5a602a2a38 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 3502365a-f88a-4ba4-822a-5769d3073b65 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d 60b3ec1b-9545-4921-821f-311b129dd6f6 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 6365275e-368d-46ca-a0ef-fc0404119333 721f9237-9341-4453-a661-09e8baa6cca5 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 82bbc092-bc50-4e16-8e18-b74fc486aec3 8ab9bdd1-1f67-4997-82d9-8878520837d9 8b351c9c-f398-4515-9900-09df49427262 90da7373-1c51-430b-bf26-c97e9c5cdc31 92fb8726-92a8-4ffc-94ce-f82e07444653 95dca82f-385d-4d39-b85b-5c73fa285d6f a48938aa-62fa-4966-9d44-9f04da3f72f2 b0773a15-df3a-4312-9ad2-83d69648e356 b4bfe195-541e-4e64-ad23-6177f19e395e b68e61d2-68ca-4757-be45-0cc2f3e68eee bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 df96023b-dcd9-4be2-afa0-c6c871159ebe e0c42288-980c-4788-a014-c080d2e1926e e4db50ea-bda1-4566-b047-0ca50abc6f07 e558417a-5123-4f6f-91e7-385c1c7ca9d4 e7a950a2-e548-4f10-bf16-02ec848e0643 eb6d346f-1c60-4643-b960-40ec31596c45 ec868e65-fadf-4759-b23e-93fe37f2cc29 ef51e000-2659-4f25-8345-3de70a9cf4c4 f7af7d09-40e4-419c-a49b-eae366689ebd fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab fe74f55b-0338-41d6-b267-4a201abe7285 " "
      4⤵
      PID:2440
  - - C:\Windows\System32\find.exe
      find /i "4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c"
      4⤵
      PID:4532
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="VK7JG-NPHTM-C97JM-9MPGT-3V66T"
      4⤵
      PID:2516
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      PID:2400
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
      4⤵
      PID:4044
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul
      4⤵
      PID:936
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Control Panel\International\Geo" /v Name
        5⤵
        
        PID:1736
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul
      4⤵
      PID:3640
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Control Panel\International\Geo" /v Nation
        5⤵
        
        PID:1992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_f28a3656-1f51-4b53-b965-647ab52a4c07.cmd') -split ':sign\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      PID:1000
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service ClipSVC } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      PID:4344
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4476
  - - C:\Windows\System32\ClipUp.exe
      clipup -v -o
      4⤵
      PID:5228
    - - C:\Windows\System32\clipup.exe
        
        clipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\tem29C3.tmp
        5⤵
        Checks SCSI registry key(s)
        
        PID:5252
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
      4⤵
      PID:5344
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5360
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 Pro" "
      4⤵
      PID:5472
  - - C:\Windows\System32\find.exe
      find /i "Windows"
      4⤵
      PID:5480
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate
      4⤵
      PID:5504
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b -2147012894
      4⤵
      PID:5712
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
      4⤵
      PID:5728
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:5736
  - - C:\Windows\System32\reg.exe
      reg delete "HKU\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:5840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service wlidsvc } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      PID:5856
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service LicenseManager } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      PID:5172
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service sppsvc } | Wait-Job -Timeout 20 | Out-Null"
      4⤵
      PID:1048
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5232
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
      4⤵
      PID:2412
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate
      4⤵
      PID:5564
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      PID:5624
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
      4⤵
      PID:5640
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:5648
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL"
      4⤵
      PID:5700
  - - C:\Windows\System32\reg.exe
      reg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "State" /f
      4⤵
      PID:5516
  - - C:\Windows\System32\reg.exe
      reg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "SuppressRulesEngine" /f
      4⤵
      PID:5724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Stop-Service sppsvc -force } | Wait-Job -Timeout 20 | Out-Null; $TB = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$TB.DefinePInvokeMethod('SLpTriggerServiceWorker', 'sppc.dll', 22, 1, [Int32], @([UInt32], [IntPtr], [String], [UInt32]), 1, 3); [void]$TB.CreateType()::SLpTriggerServiceWorker(0, 0, 'reeval', 0)"
      4⤵
      PID:5504
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5808
  - - C:\Windows\System32\choice.exe
      choice /C:10 /N
      4⤵
      PID:6008
  - - C:\Windows\System32\mode.com
      mode 76, 34
      4⤵
      PID:5888
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:5912
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:5896
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:5976
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:5988
  - - C:\Windows\System32\choice.exe
      choice /C:12345678EH0 /N
      4⤵
      PID:5156
  - - C:\Windows\System32\mode.com
      mode 100, 36
      4⤵
      PID:5068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=35;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"
      4⤵
      PID:4680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Windows\Temp\MAS_f28a3656-1f51-4b53-b965-647ab52a4c07.cmd') -split ':sppmgr\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      PID:5012
  - - C:\Windows\System32\mode.com
      mode 76, 34
      4⤵
      PID:5248
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:5376
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:5456
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:5244
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:5432
  - - C:\Windows\System32\choice.exe
      choice /C:12345678EH0 /N
      4⤵
      PID:5428
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:1000

C:\Windows\system32\Clipup.exe
"C:\Windows\system32\Clipup.exe" -o
1⤵
PID:3160
- C:\Windows\system32\Clipup.exe
  "C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\SystemTemp\tem28E9.tmp
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:2040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4224

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap14014:88:7zEvent26616
1⤵
PID:1956

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap25975:88:7zEvent18939
1⤵
PID:2460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GenuineTicket

Path C:\ProgramData\Microsoft\Windows\ClipSVC\GenuineTicket\GenuineTicket
Size 1KB
SHA256 1d19fed36f7d678ae2b2254a5eef240e6b6b9630e5696d0f9efb8b744c60e411
MD5 67a8abe602fd21c5683962fa75f8c9fd
SHA1 e296942da1d2b56452e05ae7f753cd176d488ea8
SHA512 70b0b27a2b89f5f771467ac24e92b6cc927f3fdc10d8cb381528b2e08f2a5a3e8c25183f20233b44b71b54ce910349c279013c6a404a1a95b3cc6b8922ab9fc6
TLSH
T1351123B0D2215C40236D27B0C7747EF77B18704BC2B38856FB41965431EB29327521A2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 87f19edb6c133f7de65631a68655a64fdfda264479ace683ceb45339ab2e7add
MD5 3d4b9b9ce43fc3debe8e3d8f9a735771
SHA1 27c2bbb64530d0f3363d5cf78e66c2fdaab8ba50
SHA512 65776c1f7e2f929030931c0e91b521ed04f62057d4b62df0279ec5aaec17c90c3ff557bdf489fcc71ab2cefb8fb24478596291598e3977793c7d196245c07353
TLSH
T1AFF0F9B6C921AC2728FD0B5960594B47EB55136B2750495F3A3D420D8FB1637858591C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000025

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025
Size 34KB
SHA256 506dbf574eed19e153cdf2efd31911cdd66ff943d7e63fae4cfd98a6f2257c42
MD5 bf62c99e025b43aafaa5f9138d725de7
SHA1 2c4a2d5d943a78055fbfb1307089e02acb84c4cd
SHA512 bf1fb64da900e9557a1490efd80ee6c4fc79888e7817ed1381c65f3b3821ae6c3df0407ddc45f30b80ac5319564a7f98b8ec78fd270f2635481ef969fa0368b1
SSDEEP 768:OohMCQtDyUkScr9AnZC60pzDF/ZXgkTbHYQ0qx2vtOqjH9Tdeo:O4MTdyprGnmpF/ZFqTvtx9Tx
TLSH
T1F2F2F1BF773BD96FCABC6E96D61FB6F51C2B9CD2115ADB430C14A034A1208F0455A09B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 1a67cd9f012aece2aa7e123d47ed5ce48b104e37e1c0784a67911f1f768fd8b8
MD5 a5853531f330716e5088ff5121992b30
SHA1 9c0e74ba88985a288a29df8eff67d33f13acde6b
SHA512 5af244134a8a9c58dd62c928f1ff05aadce8328d9f9a1123945ff97a1dbc56f56949bd54496760c7710a24617a65efef8308a1a55581d090743c60c26456fd8d
TLSH
T14711261D15A56B66FFB83B70CC95CE2669A10B544E491F3A53407C1F69C3EB4C048721
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c9de2cdf9fe7b7f43cd6a78fa75228f0142b8196baaaa3d1dfef3b9ea948fbaa
MD5 a85ece0199545a6e68db2104f80fb868
SHA1 19b092df7d7327290348c077fe32d4fa4d19e4c6
SHA512 8c4a304a1c1383d9ea8c916e5ea010575a7b1d6f92a7da3274122203a25c76eb1f378cbe850d2d1c93ffa4c52d88be26a0f79107fd11c3e831584e296216225d
TLSH
T1EA11451D19A95BA6FFF83B70CC96CE2629A10B644E492F3A53507C2F68C3FB4C048711
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 05bd491f716a38c88bf61e60ce24818c3a820de354db42b40ab248d0394d3e8b
MD5 b57c8438520884f30fa70974adcf17cf
SHA1 019d3e33fd1ca28abc02da55922554523b6995e3
SHA512 7f05a6ac5fed2e108c063356f0879459ff40f3774d0a7c9ed3435a6428179dbacaa73e1dbc037951b0049d6ec7e82cdbe81ca01a9383fd40283f0a84ff7ca4af
TLSH
T12131761D2AA56BA1FFA83B70CCD5CA16EC900A548E481F7A53507C5F34C7EB4C10531A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 dcec2cf7d1bf466c4c7ba25695b227479ef749f2c8617db8fbc8146516e989d2
MD5 118c2a128d3bba45ba2abd7d3f047295
SHA1 fed71e300e5dc5a17028f275dfc19d4be5330a22
SHA512 bea02d201209b5c93a6a9d90ff391ef8339cf26940c3f3de98d58ecdb6f6ba14dacae7b7572d6666e6a35a4238f1e5eb7f88432db6b017c8c43be023b110ea00
TLSH
T17331632C2AA67791FFA43B30CCD9CA56EC904A548E482F7A43503C5F34C7EB4C14532A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b50bb4fe018d892d84bb6501cd4067ed07206b45e9ea90246c03fb7853327f9b
MD5 300bb8d881953254310ef92a471b242d
SHA1 7fd13715755d14cbcd7c067c76612a7f00e9d14a
SHA512 3db854311a5892e99bf9b4d6c564c5a9ec32db827338164496bf65e27a79010f4fafbc761587d7bbccf59b4a166d1a1a8ea33bbce9d3e213e27ed5cd9b18d350
TLSH
T11631441C26A57B91FFA83B70CCD5CA66EC904A588E491F7A53947C5F24C7EB8C04531B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 f6c9c76116412772b03e20580626ac92862124d8e34c994cdbd9f8efb435d14e
MD5 4cee921d8c0789d1477ae3d86b3b63f7
SHA1 54ef58f7abaa316e934e0afcd10d2e577102402d
SHA512 e6c938c65a2894e92c67ab5c8d195ebea4be2419f1ae7de53967ecbfd6824551cfc6fa61005d3423c9aa6c536279d6c2ce07d188c9eab0029ddc596541ff2d2f
SSDEEP 192:D9REApryMruBD52ibHka/e/9Vacpf0Ne1:D9REApryMruBD52ibHka/e/9Vacpf0NC
TLSH
T199D15CB3C7D8862DC81156F8A7166F1FCE290E2453193C66C8D9EF4B93E28B1E21135E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 be36afd56e326389bdaefb6bfd1eaac8313a2678c19d7ca3953f0d70e8897cc9
MD5 ff215fda0c706406cca247ff96fe1789
SHA1 118c6bf8dabc84d6a3bdc1977815838feaae3058
SHA512 04a418d5600f4c900cf83ed71ae8350bbdcb74cbca2ffae7eba8423b706d0bc47873cbe7fbc8a1dd2dfd63f8912c6683c716b9de831e09af72ca018aad429ec1
SSDEEP 192:D9REApryMrNy9gBDkCffacpf+jhneigXxoKvOY2URKIwvLGK6:D9REApryMrNy9gBDkCffacpf+5jgXxoO
TLSH
T13F028DF7C3E8862DC81156F8A7156F2FCE290E1453283C66C8D9EF4B93E1871E21265E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 7ca019fe25e54eefb5ab0e8239c79d5134550aa698d130425ade637079a62ac8
MD5 79c37f8aa69a3401132158aa623714c8
SHA1 4a05db5db6cf42491ab225655bc73aa031d2efcf
SHA512 b1f8bb0151f0678e2be0c730c4f07977e3e5840c5c03d1da887212598d32aba0c1864d8b131d80c5f05eaed668e1d996e503919ac5e8dc2dec8b391ce53db77a
SSDEEP 192:DBh1HgitxlGy9gBDkiffUK+jhneyEdoKvSqRKIQmMZGCBW:DBh1HgitxlGy9gBDkiffUK+5PEdoqSqr
TLSH
T19AE1AFF7C3E8C62DC91156F4A715AF2FCE290924432C3C66C9D4AE1B93E2972E21574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7dd866b9845867caa29a5aceeb252d0e5840ffc4616c6ab1e945ca976ec12349
MD5 c82473011ae9f07aa82e604257662571
SHA1 6c21bddd60e293017dd50b075293759e7ffe4fc3
SHA512 2bab47275539f3c12f7037b87b32188f2963eaac8e2282a6ec99195207f09b1786de8c54f76e8739b6f3a324fae4d6e6c984c581e7ba5a1c79d69558845ae293
SSDEEP 192:sRzcBz01Y32Kaiv7sBpAPRp2aJq9NHsb+WNned4nM2Qa2qegoVyIsnAUgtaJ:sRzmz4ju8UXErws72r2r8
TLSH
T14042F76FB920657B6CDBD26AF9267713D7F5102132D42D84EAFC8A2C19E75CC221B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 782f925f46a940892c83e9893f00e6b3cc012797dc16de00f3ba9ab7d6095773
MD5 6f2eee5e86a7d58d33c4fdafd444ccb4
SHA1 11636d57c45e73a655470890f976b7bc414f4491
SHA512 b90836888ee89cbeaeb22e0143e62e51c5f830d0fa4890c9f3b35f9d279a803c75864383285086ef929db6df3f5d5a6c38e515e6a4d53e2a19ae8e0a5f856e36
SSDEEP 192:/RzcBz01K32KTqv7sBpRPRptasL2O9NHsb+WNKfbgCVrg+A3Wza2qegzVyIsnAUp:/Rzmz4Mm83Xjrw3JdWm2se
TLSH
T17652D72BA91029776DDBD26AF9267757E3F5103122D02D84EAFC8E2C19E79CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ffd2d1905af36b1744ca7980e50c138f1912d4930c87641ee878b7fbc3e295d6
MD5 108abb83bdf8d4d99dd651ee37162a99
SHA1 4e96ad042fcb4119ce6912142a323d9c3d402ed5
SHA512 7567dda1cd59d810afeb7cbe55e71f7cc01b2e6278a5596adff8a9d95797a27a9f7cf9568baf3643335cf0773bc396dc5ee2ffb329d40213555f97fe0125fa5f
SSDEEP 192:/RzcBz01K32KTIv7sBpRPRptLjxsL2Cjk9NHsb+WNxLbgCVrg+A3Wza2qegzVyI6:/Rzmz4MU83Xvrw6JdWm2se
TLSH
T1D352D76BA91029776DDBD26AF926B757E3F5102122D01D84EAFC8F2C18E79CC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 280ef19d296c12f7b9e3cd5b1fcda3b95c7af97f1c1de7d6a164f8cd321cf143
MD5 43b042bc9e566525ace71005619597d5
SHA1 13b970bf01e716ef3b8a0fc1c4af863128c54878
SHA512 ec042c167b69dd92acd334da27969aeb2c7ecc0475b2f3c36247315827ff89cd895b45891e78d091d18b5ca3193fdf4cb217ae89aa286f4a9854f42acd54eb54
SSDEEP 192:/RzcBzy1K32KTtv7sBpRPRptLjxsL2Cjz9NHsb+WNxLbgCVrgXWFMA3W1a2qegzN:/RzmzuMN83XYrw6J4TWw2be
TLSH
T1AB62D77BA9102977ADDBD26AF926B757E3F5202122C01D84EAFC8F2C18D79CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6a099980875865edf959532c67b647040b2a38c4083b1511ae1a29a2c58f06d4
MD5 6096263389a9176ae0d519bb0c5b190e
SHA1 cee24f5e9bb7a8f7a359c31eb5742133ed722abf
SHA512 a5d046222caac4b820c402213443d381f86f823a7756ecc72cffe9e53aa2dbe1984f9edac8d32b32fc010827fa176646d78021c3952fb9dae7e8ca7a2c38a73e
SSDEEP 192:/RzcBz01K32KTMv7sBpRPRptLjxsL2Cjz9NHsb+WNxLbgCVrgXWFMA3W1a2qegzN:/Rzmz4MY83XYrw6J4TWw2be
TLSH
T1DF62D76BA9102577ADDBD26AF926B757E3F5203122C01D84EAFC8F2C18D79CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 da6612a6c3d56c4b2f51613d50dee75b29b82fd8d32e908a86268fe2a2eb939d
MD5 501dd645dcbb1db6fa13f7917af79815
SHA1 7d41bc7d9021b4e1004355ae812ec6df7d3be7c5
SHA512 28a3c8c78786aaebfe95369a915552bcc924416cc9a8d311e7c548e8805efc2d605635fcf1f2a8c5f2a0ced81cb6b610847d58b9c0ca8e5f7cb078a247e3b03d
SSDEEP 192:sRzcBz01K32Kaiv7sBpRPRptaJb2O9NHsb+WNKfed4nM2sa2qegzVyIsnAUgraJ:sRzmz4lu83Xqrwn7232se
TLSH
T11952E76FA9102977ACDBD25AF9267717E7F5102172D02D84EAFC8B2C19E75CC220B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 0d2a156654c1c543f684a1b78fc1acde7a605db8760d180da55c6029bd11d4cc
MD5 fca0a080e03e1f9f1f1ec2f425ee2b0e
SHA1 04435d408b3c935d0c54889e9019a986e7e3d26e
SHA512 0133469141ee35d9bb385a53718d74af5f96fe7ea3c4d774df026da6bbcd201abccd4b10b8b4bb6f9e60e57cecfd324ba1f320a5bc5ef4bba05fdb56deff9ffe
SSDEEP 384:7tjtw7KxkXqKf/pUZNCgVLH2HfgslsD7pLuLcSj5EXODtw+ErU3U2HG4B6T6:7ttw7KxkXqKf/pUZNCgVLH2HfgsiD7pa
TLSH
T14572F9A76C4C8E770F94CACCDC16BB4FADB5024B65E9886487FA581903D5BCB110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c157815325caaa6bdf1337a0fb978eaf3f903c1b9f9beefc067d693c6684fa89
MD5 7fe6ed18375f954bd05275e305442292
SHA1 c5700d621492af3f6273d5332a23332b329945e8
SHA512 d8246373cc2e7df08ca8ac53377c936c85b7ede603cde7902425c6917340211c48e069c703d3d70dad0c4271aac411274c256cdf32e8a864f36d58051daefa72
TLSH
T1D1B01211C0015701C44312B09A52559AF2685F10DE0B270243E4A922D829161C024152
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5f671f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5f671f.TMP
Size 96B
SHA256 f7eb026956e9d8c7fcb10d943f8cf9ec7374d838a429967b8013603979bda2fc
MD5 0db1358b8251bb9eeb1985693c80e150
SHA1 8adcd2d10c6018244245e0414aa5553a07dcd661
SHA512 1fce1d3085deebec539b4a3924a46434c5841789a633f0e78f24b20c3508dc70e3d69faaf0a40f9c94cd71ca2f13523b2bd30fb2202d4cc7a767178aa0887767
TLSH
T1ABB0222CC082A302C00203F02E8080C8B030EF32C203022382E00E32CC20AF08020820
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 5cd5d01d353a422685bf99ec15f5e29fc259b105bc8b723556e0cefce933df5f
MD5 a5eb458021d32e7fd201d7b90b137b3a
SHA1 21f2b245090d0800ed5ecf2c190c977bb920dc74
SHA512 bfcfd7d350ae418831b465302e33f9f5111a9895317ab02b3821204d237e9384466a339de635779551c226b9d9a05266a608f6a08312213573c523723ed0b741
TLSH
T12EA0021429C40811DC0022F59BA6A5D0236988146342D70385914184C8621829219744
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 231KB
SHA256 97fd2130ecd9cba21225b26912d323246567761c7420ed47e205950f09b497d3
MD5 b2d5d563c483034bfaad641b14e8edea
SHA1 c3e51b93bcdad8a347d324999143c720a05a5e0a
SHA512 10b65081e03c4ffd43d4a83ed1e20320bb63ce4b911bcc937699d6940a82624dbd16c216cdc6c27dc27ec077c854567e78e85a6338ee55b6dea7c3a5b9429147
SSDEEP 6144:8/m/kPmN86MiPEURFgI1PTDnm7Rkm1tYpBeh2BAod:BcONRsiG9oBGcAod
TLSH
T1673422279D1FBD3A1939B356B14E632F0EB1A9BADD264EC585C84F409BBC8851B04C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 9202b82a8bfb6e56fffb23691f0f1771d0fb5b95b566ff76765be0500f846b18
MD5 d0551d9bafa550355cfd9791673d112d
SHA1 01665b18b7916d86357378fb93f3ba1f18eb1560
SHA512 1bb6c9989585580317d2b10318b20aa5893cbd39321a820e1d55dcdd34de2827760ae755363995e2fa3664fa75f6923c3daf7ee61177ed3ab3b2601608f5f234
SSDEEP 6144:w/m/kPmN86MiPEURFgI1PTDnm7Rkm1tYpBeh2BAod:1cONRsiG9oBGcAod
TLSH
T16F3412379D1FBD3B0939B716B14D631F0DB1A5BBDD298E8989C84F408BAC8891B04C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 1f9f0355ff6a007695a38d9062389b4d2a8287919d9fe868a3b039608788b4f1
MD5 23cc6a39f3add2f25051ac2849c8c9ec
SHA1 6c57256673335c507c7c53526f8348430869beb3
SHA512 423891b82aef5d94a2c15cef4e1fd29be3e7a7a7a1c5b4e28d98fb3c4f8a24ca9356043f934e8fafd61c2251bdebd42b6ba4e51ce17aa39348827e694b802c72
SSDEEP 3072:RGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMe:Am7Rkm1tYpBeh2BAoe
TLSH
T127C312375E75A97759B5BB4EB08E0B1F1EF14EA6C920DE82C8D85B0427EA7CC0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 3d8a089a547852e23b453dc6a53dd966491d5be6802adc70af69b64e2f020477
MD5 c11100eaf5df516dcd0a3b7b559a7648
SHA1 6adb0cb3f98fe8e2e17f720a2924a833ba71ee76
SHA512 c33aec847a10bcb5840d661a8c2e7c585923bcc9e141d559c6f6c99ee6d9e8e884150cbf055445c755a4b9aeccb4bbe554efa08d81078f255b4923ed9348185b
SSDEEP 3072:IGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMn:jm7Rkm1tYpBeh2BAon
TLSH
T124C3123B5D74A8375DB6BB5EB08E0B1F1EF149A7C920DE92C8D45B0427EA7CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 861649153ed1645b73f1565407569ecc51ff081c225da368e7038dcf1c56adf4
MD5 b06c171ea83ed4881e82b4713a88f455
SHA1 e05b5d7a2b673aeffd72ee335e12125260fbc83b
SHA512 c30af9e63cfe5e981c77950700a1671e768683a3f8c18f4763bbff0b0021fe79596ef59d0afe4497e2f9bdc7c24355267696ae2f713f250acda2df8b5000bfc8
SSDEEP 6144:J/m/kPmN86MiPEURFgI1PTDnm7Rkm1tYpBeh2BAod:YcONRsiG9oBGcAod
TLSH
T1FF3412379D1FBD3A1979B716B14D631F0DB1A5BBDD298E8989C84F409BAC8891B04C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 ea18f2f5cb7a3b0a1dd7fb69a90ad30c931c548fed1dcf742ab4def45c1d7175
MD5 8ac72106b0affcd3e090ea6092c41e2f
SHA1 5953f3867348d80f14960d273443b254fda8afef
SHA512 68085fb082b4685cb47bb1ddf4e851d09a223bcd92f75a0cb0275de70add9f6718c8596311a97a28d9a4e05a37fa9f1a121d158db93d2d3cbacdc9badb017a7f
SSDEEP 6144:l/m/kPmN86MiPEURFgI1PTDnm7Rkm1tYpBeh2BAod:kcONRsiG9oBGcAod
TLSH
T1FF3412379D1FBD3B1939B716B14D631F0DB1A5BBDD294E8989C84F448BAC8891B04C38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 62KB
SHA256 0079b322257ba1bda6ce5a755317dc46491f84a87987c5a9fd1b4e3c862f7167
MD5 8c96bb6b2a4b6490adbae2a12f6ec7fe
SHA1 2768907f5c05c0487d473ceebbab4afa7a85f62f
SHA512 c22a9403ebbac437130b0d37550a1453179a574937f7d3272c198e4944c740495eea0b8ee6a9d134b311c24c29b6914e5a7a8ef21ac1a4305661dfbac42d4760
SSDEEP 1536:LflJd+h4iUxUYyYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3BV3CNBQkj2zMy:LflJd+qiUUYyYkzvHgfKQaUpeE711kDM
TLSH
T19B537392E9204E75E2A65F3EF15622627D30394690F8113212DC25EFA987D930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download