hxxp://massgrave[.]dev

Resubmissions

21/07/2026, 17:06

260721-vmd48aysgz6

21/07/2026, 17:02

260721-vkfj9sysds6

21/07/2026, 16:58

260721-vg44fs1cpg8

Analysis

user interaction
yes
max time kernel
187s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 17:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://massgrave.dev
Sample260721-vkfj9sysds

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5116	powershell.exe
3848	powershell.exe
4800	powershell.exe
1272	powershell.exe
3324	powershell.exe
3952	powershell.exe
4812	powershell.exe
5124	powershell.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5548_679808390\manifest.json	msedge.exe

Launches sc.exe 54 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4600	sc.exe
4116	sc.exe
3952	sc.exe
1464	sc.exe
5096	sc.exe
5420	sc.exe
4444	sc.exe
3812	sc.exe
4792	sc.exe
2884	sc.exe
1752	sc.exe
1976	sc.exe
5216	sc.exe
4612	sc.exe
5000	sc.exe
3472	sc.exe
3616	sc.exe
3320	sc.exe
5152	sc.exe
4548	sc.exe
2076	sc.exe
4128	sc.exe
3316	sc.exe
5540	sc.exe
6044	sc.exe
5272	sc.exe
4220	sc.exe
4032	sc.exe
3268	sc.exe
5212	sc.exe
764	sc.exe
2360	sc.exe
3328	sc.exe
4616	sc.exe
4204	sc.exe
5512	sc.exe
524	sc.exe
1996	sc.exe
4416	sc.exe
3484	sc.exe
5080	sc.exe
3500	sc.exe
1724	sc.exe
1976	sc.exe
2176	sc.exe
3328	sc.exe
4136	sc.exe
5272	sc.exe
5208	sc.exe
5544	sc.exe
4804	sc.exe
2160	sc.exe
440	sc.exe
2176	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4900	cmd.exe
2980	cmd.exe
1880	cmd.exe
2100	cmd.exe
660	cmd.exe
1964	cmd.exe
5508	cmd.exe
2280	cmd.exe
2416	cmd.exe
4416	cmd.exe
4364	cmd.exe
4672	cmd.exe
5268	cmd.exe
5288	cmd.exe
5564	cmd.exe
3216	cmd.exe
1788	cmd.exe
3052	cmd.exe
5108	cmd.exe
3492	cmd.exe
4420	cmd.exe
956	cmd.exe
3192	cmd.exe
3612	cmd.exe
1696	cmd.exe
5624	cmd.exe
5264	cmd.exe
1964	cmd.exe
4452	cmd.exe
1424	cmd.exe
4536	cmd.exe
2004	cmd.exe
4348	cmd.exe
3268	cmd.exe
4792	cmd.exe
2236	cmd.exe
4060	cmd.exe
3752	cmd.exe
2860	cmd.exe
5020	cmd.exe
3624	cmd.exe
6048	cmd.exe
4684	cmd.exe
4752	cmd.exe
2220	cmd.exe
5676	cmd.exe
1036	cmd.exe
3356	cmd.exe
4904	cmd.exe
2652	cmd.exe
5044	cmd.exe
4408	cmd.exe
5424	cmd.exe
5556	cmd.exe
4360	cmd.exe
1376	cmd.exe
2868	cmd.exe
2176	cmd.exe
5528	cmd.exe
5372	cmd.exe
5392	cmd.exe
5128	cmd.exe
4864	cmd.exe
2356	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 16 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3492	cmd.exe
3328	PING.EXE
3192	PING.EXE
2980	cmd.exe
2952	cmd.exe
3612	cmd.exe
5124	PING.EXE
5752	PING.EXE
5624	cmd.exe
4420	cmd.exe
3652	PING.EXE
4408	cmd.exe
1276	PING.EXE
5040	PING.EXE
5200	PING.EXE
5392	cmd.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5764	msedge.exe
4132	msedge.exe
3320	msedge.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	Clipup.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291269716296239"	msedge.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\85dd8b5f-eaa4-4af3-a628-cce9e77c9a03	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663	reg.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{50817B41-3118-4C00-8E79-B70E76F822F8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{7435EC41-DFC4-4995-B7A1-03FFBF1C2270}	msedge.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
396	reg.exe
2488	reg.exe
3756	reg.exe
780	reg.exe
2720	reg.exe
2912	reg.exe
3332	reg.exe
8	reg.exe
5316	reg.exe
5100	reg.exe
4000	reg.exe
3484	reg.exe
4608	reg.exe
2324	reg.exe
5216	reg.exe
1864	reg.exe
5124	reg.exe
4464	reg.exe
1964	reg.exe
1904	reg.exe
4204	reg.exe
1164	reg.exe
1556	reg.exe
5352	reg.exe
5416	reg.exe
5432	reg.exe
4532	reg.exe
616	reg.exe
1596	reg.exe
1160	reg.exe
5380	reg.exe
4524	reg.exe
3264	reg.exe
3040	reg.exe
2652	reg.exe
780	reg.exe
5156	reg.exe
4332	reg.exe
3792	reg.exe
5828	reg.exe
3576	reg.exe
4136	reg.exe
3812	reg.exe
4116	reg.exe
4160	reg.exe
2512	reg.exe
4308	reg.exe
3680	reg.exe
4268	reg.exe
1276	reg.exe
4416	reg.exe
4220	reg.exe
5848	reg.exe
4760	reg.exe
5268	reg.exe
4456	reg.exe
3692	reg.exe
2320	reg.exe
4624	reg.exe
5240	reg.exe
3756	reg.exe
1336	reg.exe
1012	reg.exe
5564	reg.exe

Runs ping.exe 1 TTPs 8 IoCs

Remote System Discovery

T1018

pid	Process
1276	PING.EXE
5040	PING.EXE
5752	PING.EXE
5200	PING.EXE
5124	PING.EXE
3328	PING.EXE
3192	PING.EXE
3652	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4532	powershell.exe
4532	powershell.exe
4532	powershell.exe
3468	powershell.exe
3468	powershell.exe
3468	powershell.exe
956	powershell.exe
956	powershell.exe
956	powershell.exe
632	powershell.exe
632	powershell.exe
632	powershell.exe
4956	powershell.exe
4956	powershell.exe
4956	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
4776	powershell.exe
4776	powershell.exe
4776	powershell.exe
3952	powershell.exe
3952	powershell.exe
3952	powershell.exe
3652	powershell.exe
3652	powershell.exe
3652	powershell.exe
4616	powershell.exe
4616	powershell.exe
4616	powershell.exe
4800	powershell.exe
4800	powershell.exe
4800	powershell.exe
2952	powershell.exe
2952	powershell.exe
2952	powershell.exe
1484	powershell.exe
1484	powershell.exe
1484	powershell.exe
3748	powershell.exe
3748	powershell.exe
3748	powershell.exe
4904	powershell.exe
4904	powershell.exe
4904	powershell.exe
5376	powershell.exe
5376	powershell.exe
5376	powershell.exe
2056	powershell.exe
2056	powershell.exe
2056	powershell.exe
5188	powershell.exe
5188	powershell.exe
5188	powershell.exe
4240	powershell.exe
4240	powershell.exe
4240	powershell.exe
1272	powershell.exe
1272	powershell.exe
1272	powershell.exe
3744	powershell.exe
3744	powershell.exe
3744	powershell.exe
4812	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4532	powershell.exe
Token: SeDebugPrivilege	3468	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeIncreaseQuotaPrivilege	3308	WMIC.exe
Token: SeSecurityPrivilege	3308	WMIC.exe
Token: SeTakeOwnershipPrivilege	3308	WMIC.exe
Token: SeLoadDriverPrivilege	3308	WMIC.exe
Token: SeSystemProfilePrivilege	3308	WMIC.exe
Token: SeSystemtimePrivilege	3308	WMIC.exe
Token: SeProfSingleProcessPrivilege	3308	WMIC.exe
Token: SeIncBasePriorityPrivilege	3308	WMIC.exe
Token: SeCreatePagefilePrivilege	3308	WMIC.exe
Token: SeBackupPrivilege	3308	WMIC.exe
Token: SeRestorePrivilege	3308	WMIC.exe
Token: SeShutdownPrivilege	3308	WMIC.exe
Token: SeDebugPrivilege	3308	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3308	WMIC.exe
Token: SeRemoteShutdownPrivilege	3308	WMIC.exe
Token: SeUndockPrivilege	3308	WMIC.exe
Token: SeManageVolumePrivilege	3308	WMIC.exe
Token: 33	3308	WMIC.exe
Token: 34	3308	WMIC.exe
Token: 35	3308	WMIC.exe
Token: 36	3308	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3308	WMIC.exe
Token: SeSecurityPrivilege	3308	WMIC.exe
Token: SeTakeOwnershipPrivilege	3308	WMIC.exe
Token: SeLoadDriverPrivilege	3308	WMIC.exe
Token: SeSystemProfilePrivilege	3308	WMIC.exe
Token: SeSystemtimePrivilege	3308	WMIC.exe
Token: SeProfSingleProcessPrivilege	3308	WMIC.exe
Token: SeIncBasePriorityPrivilege	3308	WMIC.exe
Token: SeCreatePagefilePrivilege	3308	WMIC.exe
Token: SeBackupPrivilege	3308	WMIC.exe
Token: SeRestorePrivilege	3308	WMIC.exe
Token: SeShutdownPrivilege	3308	WMIC.exe
Token: SeDebugPrivilege	3308	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3308	WMIC.exe
Token: SeRemoteShutdownPrivilege	3308	WMIC.exe
Token: SeUndockPrivilege	3308	WMIC.exe
Token: SeManageVolumePrivilege	3308	WMIC.exe
Token: 33	3308	WMIC.exe
Token: 34	3308	WMIC.exe
Token: 35	3308	WMIC.exe
Token: 36	3308	WMIC.exe
Token: SeDebugPrivilege	632	powershell.exe
Token: SeIncreaseQuotaPrivilege	5096	WMIC.exe
Token: SeSecurityPrivilege	5096	WMIC.exe
Token: SeTakeOwnershipPrivilege	5096	WMIC.exe
Token: SeLoadDriverPrivilege	5096	WMIC.exe
Token: SeSystemProfilePrivilege	5096	WMIC.exe
Token: SeSystemtimePrivilege	5096	WMIC.exe
Token: SeProfSingleProcessPrivilege	5096	WMIC.exe
Token: SeIncBasePriorityPrivilege	5096	WMIC.exe
Token: SeCreatePagefilePrivilege	5096	WMIC.exe
Token: SeBackupPrivilege	5096	WMIC.exe
Token: SeRestorePrivilege	5096	WMIC.exe
Token: SeShutdownPrivilege	5096	WMIC.exe
Token: SeDebugPrivilege	5096	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5096	WMIC.exe
Token: SeRemoteShutdownPrivilege	5096	WMIC.exe
Token: SeUndockPrivilege	5096	WMIC.exe
Token: SeManageVolumePrivilege	5096	WMIC.exe
Token: 33	5096	WMIC.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe
4312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 1636	4312	msedge.exe	87
PID 4312 wrote to memory of 4132	4312	msedge.exe	88
PID 4312 wrote to memory of 2468	4312	msedge.exe	89
PID 4312 wrote to memory of 2468	4312	msedge.exe	89
PID 4312 wrote to memory of 2468	4312	msedge.exe	89
PID 4312 wrote to memory of 5112	4312	msedge.exe	90
PID 4312 wrote to memory of 5112	4312	msedge.exe	90
PID 4312 wrote to memory of 3088	4312	msedge.exe	92
PID 4312 wrote to memory of 876	4312	msedge.exe	93
PID 4312 wrote to memory of 876	4312	msedge.exe	93
PID 4312 wrote to memory of 876	4312	msedge.exe	93
PID 4312 wrote to memory of 3088	4312	msedge.exe	92
PID 4312 wrote to memory of 3088	4312	msedge.exe	92
PID 4312 wrote to memory of 3476	4312	msedge.exe	94
PID 4312 wrote to memory of 3480	4312	msedge.exe	95
PID 4312 wrote to memory of 3476	4312	msedge.exe	94
PID 4312 wrote to memory of 3476	4312	msedge.exe	94
PID 4312 wrote to memory of 3480	4312	msedge.exe	95
PID 4312 wrote to memory of 3480	4312	msedge.exe	95
PID 4312 wrote to memory of 1484	4312	msedge.exe	97
PID 4312 wrote to memory of 1484	4312	msedge.exe	97
PID 4312 wrote to memory of 1484	4312	msedge.exe	97
PID 4312 wrote to memory of 4408	4312	msedge.exe	99
PID 4312 wrote to memory of 3748	4312	msedge.exe	100
PID 4312 wrote to memory of 4408	4312	msedge.exe	99
PID 4312 wrote to memory of 3748	4312	msedge.exe	100
PID 4312 wrote to memory of 3120	4312	msedge.exe	102
PID 4312 wrote to memory of 1604	4312	msedge.exe	112
PID 4312 wrote to memory of 4684	4312	msedge.exe	113
PID 4312 wrote to memory of 3708	4312	msedge.exe	114
PID 4312 wrote to memory of 5064	4312	msedge.exe	116
PID 4312 wrote to memory of 5064	4312	msedge.exe	116
PID 4312 wrote to memory of 5064	4312	msedge.exe	116
PID 4312 wrote to memory of 4860	4312	msedge.exe	117
PID 4312 wrote to memory of 4636	4312	msedge.exe	118
PID 4312 wrote to memory of 4860	4312	msedge.exe	117
PID 4312 wrote to memory of 4636	4312	msedge.exe	118
PID 4312 wrote to memory of 4636	4312	msedge.exe	118
PID 4312 wrote to memory of 956	4312	msedge.exe	119
PID 4312 wrote to memory of 4864	4312	msedge.exe	120
PID 4864 wrote to memory of 5000	4864	cmd.exe	123
PID 4864 wrote to memory of 4776	4864	cmd.exe	124
PID 4864 wrote to memory of 2356	4864	cmd.exe	125
PID 4864 wrote to memory of 2236	4864	cmd.exe	126
PID 4864 wrote to memory of 2220	4864	cmd.exe	127
PID 4864 wrote to memory of 3484	4864	cmd.exe	128
PID 4864 wrote to memory of 4840	4864	cmd.exe	129
PID 4864 wrote to memory of 4608	4864	cmd.exe	130
PID 4864 wrote to memory of 3216	4864	cmd.exe	131
PID 3216 wrote to memory of 4224	3216	cmd.exe	132
PID 3216 wrote to memory of 2176	3216	cmd.exe	133
PID 4864 wrote to memory of 3492	4864	cmd.exe	134
PID 4864 wrote to memory of 3328	4864	cmd.exe	135
PID 4864 wrote to memory of 3756	4864	cmd.exe	136
PID 4864 wrote to memory of 4060	4864	cmd.exe	137
PID 4060 wrote to memory of 4532	4060	cmd.exe	138
PID 4864 wrote to memory of 4684	4864	cmd.exe	139
PID 4684 wrote to memory of 660	4684	cmd.exe	140
PID 4864 wrote to memory of 2720	4864	cmd.exe	141
PID 4864 wrote to memory of 3796	4864	cmd.exe	142
PID 4864 wrote to memory of 5100	4864	cmd.exe	143
PID 4864 wrote to memory of 4900	4864	cmd.exe	144
PID 4864 wrote to memory of 4000	4864	cmd.exe	145
PID 4900 wrote to memory of 764	4900	cmd.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://massgrave.dev
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffcce2c188,0x7fffcce2c194,0x7fffcce2c1a0
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,15874844451660304353,11254703072535745147,524288 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,16281159669426809521,2479809173979227749,262144 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:2
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,5108027952647772630,7521808011457254127,524288 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,5503574973346732716,5817450764360376410,2097152 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,14782911333137125926,17707844071848480584,2097152 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,984772232463851793,11958314764697579909,2097152 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,833214307836565054,16637319147093779230,2097152 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4880,i,3018755014055990352,10977169633260868075,2097152 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,5270993430316717384,4117756912370348800,524288 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,8502446396635450016,14663575816097903335,524288 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,11000306182128898025,9502590677675637424,524288 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,11000306182128898025,9502590677675637424,524288 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,8484680420818061385,10591781653764887224,524288 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,1976241534295614199,8219005326503498420,524288 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,7454130286065652993,6104535662260978289,524288 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5528,i,5122500576097632390,11155479689419264139,2097152 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,1191965496052560869,5581980836388834400,524288 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5068,i,13401613693438450068,6099220120175973475,2097152 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,1356227195878135060,1782976107824146253,524288 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\MAS_AIO.cmd" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:5000
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:4776
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "C:\Users\Admin\Downloads\MAS_AIO.cmd"
    3⤵
    PID:2356
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:2236
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:2220
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:3484
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
    3⤵
    PID:4840
- - C:\Windows\System32\find.exe
    find /i "ARM64"
    3⤵
    PID:4608
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:4224
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:2176
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\Downloads\MAS_AIO.cmd" "
    3⤵
    PID:3492
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:3328
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:3756
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4532
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:660
- - C:\Windows\System32\reg.exe
    reg query HKCU\Console /v QuickEdit
    3⤵
    - Modifies registry key
    PID:2720
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:3796
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:5100
- - C:\Windows\System32\cmd.exe
    cmd.exe /c ""C:\Users\Admin\Downloads\MAS_AIO.cmd" -qedit"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:764
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:2824
  - - C:\Windows\System32\findstr.exe
      findstr /v "$" "C:\Users\Admin\Downloads\MAS_AIO.cmd"
      4⤵
      PID:632
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
      4⤵
      PID:2176
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:3192
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:3752
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Console" /v ForceV2
      4⤵
      PID:4888
  - - C:\Windows\System32\find.exe
      find /i "0x0"
      4⤵
      PID:2520
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
      4⤵
      PID:4128
  - - C:\Windows\System32\find.exe
      find /i "ARM64"
      4⤵
      PID:1484
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
      4⤵
      Executes a command shell one-liner
      PID:4536
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
        5⤵
        
        PID:1444
    - - C:\Windows\System32\cmd.exe
        
        cmd
        5⤵
        
        PID:4532
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\Downloads\MAS_AIO.cmd" "
      4⤵
      PID:4464
  - - C:\Windows\System32\find.exe
      find /i "C:\Users\Admin\AppData\Local\Temp"
      4⤵
      PID:4956
  - - C:\Windows\System32\fltMC.exe
      fltmc
      4⤵
      PID:5000
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:2356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3468
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c mode con
      4⤵
      Executes a command shell one-liner
      PID:5108
    - - C:\Windows\System32\mode.com
        
        mode con
        5⤵
        
        PID:2824
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3492
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3328
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4420
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 updatecheck312.activated.win
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3192
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
      4⤵
      PID:1376
  - - C:\Windows\System32\find.exe
      find /i "/S"
      4⤵
      PID:4396
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
      4⤵
      PID:4600
  - - C:\Windows\System32\find.exe
      find /i "/"
      4⤵
      PID:1500
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      Executes a command shell one-liner
      PID:2416
    - - C:\Windows\System32\reg.exe
        
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        5⤵
        
        PID:888
  - - C:\Windows\System32\mode.com
      mode 76, 34
      4⤵
      PID:4956
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:3812
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:3484
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
      4⤵
      Modifies registry key
      PID:3040
  - - C:\Windows\System32\find.exe
      find /i "O365"
      4⤵
      PID:3472
  - - C:\Windows\System32\choice.exe
      choice /C:12345678EH0 /N
      4⤵
      PID:4840
  - - C:\Windows\System32\mode.com
      mode 76, 30
      4⤵
      PID:4108
  - - C:\Windows\System32\choice.exe
      choice /C:1234567890 /N
      4⤵
      PID:4696
  - - C:\Windows\System32\mode.com
      mode 115, 32
      4⤵
      PID:3488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "&{$W=$Host.UI.RawUI.WindowSize;$B=$Host.UI.RawUI.BufferSize;$W.Height=32;$B.Height=300;$Host.UI.RawUI.WindowSize=$W;$Host.UI.RawUI.BufferSize=$B;}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:956
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
      4⤵
      PID:2360
  - - C:\Windows\System32\find.exe
      find /i "AutoPico"
      4⤵
      PID:2720
  - - C:\Windows\System32\find.exe
      find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:3164
  - - C:\Windows\System32\find.exe
      find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:4956
  - - C:\Windows\System32\find.exe
      find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:2980
  - - C:\Windows\System32\find.exe
      find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:3484
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:4416
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
      4⤵
      PID:3472
  - - C:\Windows\System32\findstr.exe
      findstr "577 225"
      4⤵
      PID:1276
  - - C:\Windows\System32\cmd.exe
      cmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"
      4⤵
      Executes a command shell one-liner
      PID:2860
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path Win32_ComputerSystem get CreationClassName /value
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3308
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:4812
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"
      4⤵
      Executes a command shell one-liner
      PID:5044
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:632
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul
      4⤵
      Executes a command shell one-liner
      PID:1376
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn
        5⤵
        
        PID:4600
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:956
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4956
  - - C:\Windows\System32\find.exe
      find /i "Subscription_is_activated"
      4⤵
      PID:3812
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
      4⤵
      PID:1444
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3848
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 10 Pro" "
      4⤵
      PID:2240
  - - C:\Windows\System32\find.exe
      find /i "Windows"
      4⤵
      PID:4600
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:2360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4776
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3952
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
      4⤵
      Executes a command shell one-liner
      PID:660
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
        5⤵
        
        PID:4904
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ver
      4⤵
      Executes a command shell one-liner
      PID:1964
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2980
    - - C:\Windows\System32\PING.EXE
        
        ping -n 1 l.root-servers.net
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3652
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
      4⤵
      PID:4204
  - - C:\Windows\System32\find.exe
      find /i "AutoPico"
      4⤵
      PID:2684
  - - C:\Windows\System32\find.exe
      find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:2228
  - - C:\Windows\System32\find.exe
      find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:632
  - - C:\Windows\System32\find.exe
      find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:2868
  - - C:\Windows\System32\find.exe
      find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
      4⤵
      PID:3952
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:440
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
      4⤵
      PID:2320
  - - C:\Windows\System32\findstr.exe
      findstr "577 225"
      4⤵
      PID:1760
  - - C:\Windows\System32\sc.exe
      sc query Null
      4⤵
      Launches sc.exe
      PID:3472
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot
      4⤵
      PID:4124
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
      4⤵
      Executes a command shell one-liner
      PID:5020
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
        5⤵
        
        PID:4608
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:2176
  - - C:\Windows\System32\sc.exe
      sc query sppsvc
      4⤵
      Launches sc.exe
      PID:3328
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService
      4⤵
      Modifies registry key
      PID:3484
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description
      4⤵
      Modifies registry key
      PID:2488
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName
      4⤵
      Modifies registry key
      PID:4204
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl
      4⤵
      Modifies registry key
      PID:4116
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath
      4⤵
      Modifies registry key
      PID:4532
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName
      4⤵
      Modifies registry key
      PID:4136
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start
      4⤵
      Modifies registry key
      PID:3264
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type
      4⤵
      PID:820
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:4616
  - - C:\Windows\System32\sc.exe
      sc query Winmgmt
      4⤵
      Launches sc.exe
      PID:4600
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService
      4⤵
      Modifies registry key
      PID:4464
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description
      4⤵
      Modifies registry key
      PID:1276
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName
      4⤵
      Modifies registry key
      PID:4416
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl
      4⤵
      PID:2320
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath
      4⤵
      Modifies registry key
      PID:616
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName
      4⤵
      Modifies registry key
      PID:3756
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start
      4⤵
      Modifies registry key
      PID:1964
  - - C:\Windows\System32\reg.exe
      reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type
      4⤵
      Modifies registry key
      PID:4608
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:2176
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:3328
  - - C:\Windows\System32\sc.exe
      sc query sppsvc
      4⤵
      Launches sc.exe
      PID:3484
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:4364
  - - C:\Windows\System32\sc.exe
      sc start sppsvc
      4⤵
      Launches sc.exe
      PID:4204
  - - C:\Windows\System32\sc.exe
      sc query Winmgmt
      4⤵
      Launches sc.exe
      PID:4116
  - - C:\Windows\System32\find.exe
      find /i "RUNNING"
      4⤵
      PID:2952
  - - C:\Windows\System32\sc.exe
      sc start Winmgmt
      4⤵
      Launches sc.exe
      PID:4136
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      PID:3356
  - - C:\Windows\System32\find.exe
      find /i "computersystem"
      4⤵
      PID:4408
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService get Version
      4⤵
      PID:3952
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      Executes a command shell one-liner
      PID:4416
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "0" "
      4⤵
      PID:3748
  - - C:\Windows\System32\findstr.exe
      findstr /i "0x800410 0x800440 0x80131501"
      4⤵
      PID:4800
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d
      4⤵
      PID:3756
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul
      4⤵
      Executes a command shell one-liner
      PID:1964
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore
        5⤵
        
        PID:4608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3652
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4616
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4800
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
      4⤵
      PID:2684
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"
      4⤵
      PID:4364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2952
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul
      4⤵
      PID:4124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1484
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"
      4⤵
      PID:4800
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"
      4⤵
      PID:3308
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4364
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE
        5⤵
        
        PID:3652
  - - C:\Windows\System32\reg.exe
      reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
      4⤵
      PID:4136
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:4672
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE
        5⤵
        
        PID:4464
  - - C:\Windows\System32\sc.exe
      sc query wlms
      4⤵
      Launches sc.exe
      PID:3952
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"
      4⤵
      PID:1556
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"
      4⤵
      PID:3796
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"
      4⤵
      PID:3368
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"
      4⤵
      PID:4600
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:2868
    - - C:\Windows\System32\reg.exe
        
        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"
        5⤵
        
        PID:2488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3748
  - - C:\Windows\System32\findstr.exe
      findstr /i "KMS_"
      4⤵
      PID:4896
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:2176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4904
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "
      4⤵
      PID:4800
  - - C:\Windows\System32\find.exe
      find /i "Ready"
      4⤵
      PID:1484
  - - C:\Windows\System32\reg.exe
      reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f
      4⤵
      PID:3832
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"
      4⤵
      PID:632
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "
      4⤵
      PID:3164
  - - C:\Windows\System32\findstr.exe
      findstr /i "Removed Not Found"
      4⤵
      PID:3576
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe" /f
      4⤵
      PID:3756
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f
      4⤵
      PID:2680
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe" /f
      4⤵
      PID:4840
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName
      4⤵
      PID:2360
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /reg:32
      4⤵
      PID:3484
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort
      4⤵
      PID:3808
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /reg:32
      4⤵
      PID:3848
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v DisableDnsPublishing
      4⤵
      PID:3612
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v DisableKeyManagementServiceHostCaching
      4⤵
      PID:5096
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f" /f
      4⤵
      PID:3512
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f
      4⤵
      PID:4616
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /reg:32
      4⤵
      PID:4800
  - - C:\Windows\System32\reg.exe
      reg delete "HKU\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f" /f
      4⤵
      PID:2952
  - - C:\Windows\System32\reg.exe
      reg delete "HKU\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f
      4⤵
      Modifies data under HKEY_USERS
      PID:820
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName
      4⤵
      PID:4844
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort
      4⤵
      PID:4600
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v DisableDnsPublishing
      4⤵
      PID:3264
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v DisableKeyManagementServiceHostCaching
      4⤵
      PID:3620
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\59a52881-a989-479d-af46-f275c6370663" /f
      4⤵
      PID:1788
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f
      4⤵
      PID:2320
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
      4⤵
      PID:4204
  - - C:\Windows\System32\findstr.exe
      findstr /i "Windows"
      4⤵
      PID:3484
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL and Description like '%KMSCLIENT%'" Get Name /value 2>nul
      4⤵
      Executes a command shell one-liner
      PID:3356
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL and Description like '%KMSCLIENT%'" Get Name /value
        5⤵
        
        PID:1276
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:1788
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE
        5⤵
        
        PID:4956
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 0ad2ac98-7bb9-4201-8d92-312299201369 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5 221a02da-e2a1-4b75-864c-0a4410a33fdf 291ece0e-9c38-40ca-a9e1-32cc7ec19507 2936d1d2-913a-4542-b54e-ce5a602a2a38 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 3502365a-f88a-4ba4-822a-5769d3073b65 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 60b3ec1b-9545-4921-821f-311b129dd6f6 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 6365275e-368d-46ca-a0ef-fc0404119333 721f9237-9341-4453-a661-09e8baa6cca5 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 82bbc092-bc50-4e16-8e18-b74fc486aec3 8ab9bdd1-1f67-4997-82d9-8878520837d9 8b351c9c-f398-4515-9900-09df49427262 90da7373-1c51-430b-bf26-c97e9c5cdc31 95dca82f-385d-4d39-b85b-5c73fa285d6f a48938aa-62fa-4966-9d44-9f04da3f72f2 b0773a15-df3a-4312-9ad2-83d69648e356 b4bfe195-541e-4e64-ad23-6177f19e395e b68e61d2-68ca-4757-be45-0cc2f3e68eee bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 df96023b-dcd9-4be2-afa0-c6c871159ebe e0c42288-980c-4788-a014-c080d2e1926e e4db50ea-bda1-4566-b047-0ca50abc6f07 e558417a-5123-4f6f-91e7-385c1c7ca9d4 e7a950a2-e548-4f10-bf16-02ec848e0643 eb6d346f-1c60-4643-b960-40ec31596c45 ec868e65-fadf-4759-b23e-93fe37f2cc29 ef51e000-2659-4f25-8345-3de70a9cf4c4 f7af7d09-40e4-419c-a49b-eae366689ebd fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab fe74f55b-0338-41d6-b267-4a201abe7285" "
      4⤵
      PID:3796
  - - C:\Windows\System32\find.exe
      find /i "2de67392-b7a7-462a-b1ca-108dd189f588"
      4⤵
      PID:2684
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="W269N-WFGWX-YVC9B-4J6C9-T83GX"
      4⤵
      PID:960
  - - C:\Windows\System32\cmd.exe
      cmd /c exit /b 0
      4⤵
      Executes a command shell one-liner
      PID:4904
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
      4⤵
      PID:3472
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket /t REG_DWORD /d 1 /f
      4⤵
      PID:2824
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (Name like '%windows%' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get ID /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:3192
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where (Name like '%windows%' and Description like '%KMSCLIENT%' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get ID /VALUE
        5⤵
        
        PID:3264
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' get GracePeriodRemaining /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:1880
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' get GracePeriodRemaining /VALUE
        5⤵
        
        PID:1340
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' get LicenseFamily /VALUE" 2>nul
      4⤵
      Executes a command shell one-liner
      PID:2004
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' get LicenseFamily /VALUE
        5⤵
        
        PID:4708
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -4 -n 1 win.kms.pub 2>nul
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4408
    - - C:\Windows\System32\PING.EXE
        
        ping -4 -n 1 win.kms.pub
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1276
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "23.226.136.46"
      4⤵
      PID:4092
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "23.226.136.46" /reg:32
      4⤵
      PID:2076
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"
      4⤵
      PID:2280
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:32
      4⤵
      PID:4108
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "23.226.136.46"
      4⤵
      PID:924
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"
      4⤵
      PID:380
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "23.226.136.46"
      4⤵
      PID:2772
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "23.226.136.46" /reg:32
      4⤵
      PID:4576
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688"
      4⤵
      PID:1596
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:32
      4⤵
      PID:1120
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' call Activate
      4⤵
      PID:2492
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /c ping -4 -n 1 kms.03k.org 2>nul
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2952
    - - C:\Windows\System32\PING.EXE
        
        ping -4 -n 1 kms.03k.org
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5040
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "23.226.136.46"
      4⤵
      PID:5284
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "23.226.136.46" /reg:32
      4⤵
      PID:5236
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"
      4⤵
      PID:5136
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:32
      4⤵
      PID:5124
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServiceName /t REG_SZ /d "23.226.136.46"
      4⤵
      PID:5324
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v KeyManagementServicePort /t REG_SZ /d "1688"
      4⤵
      PID:5372
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "23.226.136.46"
      4⤵
      PID:5356
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServiceName /t REG_SZ /d "23.226.136.46" /reg:32
      4⤵
      PID:5336
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688"
      4⤵
      PID:5380
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:32
      4⤵
      PID:5292
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where ID='2de67392-b7a7-462a-b1ca-108dd189f588' call Activate
      4⤵
      PID:5212
- - C:\Windows\System32\reg.exe
    reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,9563987722984450836,8452526103502092774,524288 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,17608957156087576689,4772443681694220968,524288 --field-trial-handle=2468,i,16277596891478647550,14346123105852904647,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:1952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault4f1e787ahec03h4ae0hbd44h92be1b4a1eee
1⤵
PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault4f1e787ahec03h4ae0hbd44h92be1b4a1eee --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x264,0x7fffcce2c188,0x7fffcce2c194,0x7fffcce2c1a0
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,3569800064314407230,217887505404410427,262144 --field-trial-handle=2104,i,16541564138938106857,13695208720894072390,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
    3⤵
    PID:3144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,14079854157564202890,10668033561357663227,524288 --field-trial-handle=2104,i,16541564138938106857,13695208720894072390,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,1711287666756159775,16355672646191277334,524288 --field-trial-handle=2104,i,16541564138938106857,13695208720894072390,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
    3⤵
    PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffcce2c188,0x7fffcce2c194,0x7fffcce2c1a0
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,3570764114230176696,5197138586691300820,524288 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,7797231044195202346,7795065015388090269,262144 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,4304295226214088128,4412522077445445809,524288 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,1981401332475828456,2785238623605532686,524288 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,1981401332475828456,2785238623605532686,524288 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,3368403461689958907,10090821714751321617,524288 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,1791724495780014354,14914190442191131440,524288 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,9716640765002736957,5752181509755799315,524288 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,1995397041280075635,1082065533327196277,524288 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,14657149408147850385,15109614441741196812,524288 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,879463134731749261,6424270977431637768,524288 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,11897299891707702702,17543885028900758908,524288 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,17744728831177287383,12751061807515218372,524288 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,11927646512196284317,3399001067111876561,524288 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,9139887552500891373,12856914699040710300,524288 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,9858320114182469233,14451408762979002611,524288 --field-trial-handle=2124,i,15680890128686071137,5314740608833420792,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5928

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\MAS_AIO.cmd" "
1⤵
- Executes a command shell one-liner
PID:4752
- C:\Windows\System32\sc.exe
  sc query Null
  2⤵
  - Launches sc.exe
  PID:3316
- C:\Windows\System32\find.exe
  find /i "RUNNING"
  2⤵
  PID:4872
- C:\Windows\System32\findstr.exe
  findstr /v "$" "C:\Users\Admin\Downloads\MAS_AIO.cmd"
  2⤵
  PID:4512
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ver
  2⤵
  - Executes a command shell one-liner
  PID:5268
- C:\Windows\System32\reg.exe
  reg query "HKCU\Console" /v ForceV2
  2⤵
  PID:5096
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:2788
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
  2⤵
  PID:968
- C:\Windows\System32\find.exe
  find /i "ARM64"
  2⤵
  PID:4524
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
  2⤵
  - Executes a command shell one-liner
  PID:2220
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
    3⤵
    PID:5160
- - C:\Windows\System32\cmd.exe
    cmd
    3⤵
    PID:5132
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\Downloads\MAS_AIO.cmd" "
  2⤵
  PID:5240
- C:\Windows\System32\find.exe
  find /i "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  PID:3564
- C:\Windows\System32\fltMC.exe
  fltmc
  2⤵
  PID:5236
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5376
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c mode con
  2⤵
  - Executes a command shell one-liner
  PID:5424
- - C:\Windows\System32\mode.com
    mode con
    3⤵
    PID:3704
- C:\Windows\System32\reg.exe
  reg query HKCU\Console /v QuickEdit
  2⤵
  - Modifies registry key
  PID:2512
- C:\Windows\System32\find.exe
  find /i "0x0"
  2⤵
  PID:4508
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
  2⤵
  - Modifies registry key
  PID:2652
- C:\Windows\System32\cmd.exe
  cmd.exe /c ""C:\Users\Admin\Downloads\MAS_AIO.cmd" -qedit"
  2⤵
  - Executes a command shell one-liner
  PID:3624
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:5272
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:2964
- - C:\Windows\System32\findstr.exe
    findstr /v "$" "C:\Users\Admin\Downloads\MAS_AIO.cmd"
    3⤵
    PID:2848
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:5544
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:4108
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:5528
- - C:\Windows\System32\reg.exe
    reg query "HKCU\Console" /v ForceV2
    3⤵
    PID:5508
- - C:\Windows\System32\find.exe
    find /i "0x0"
    3⤵
    PID:3468
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
    3⤵
    PID:2772
- - C:\Windows\System32\find.exe
    find /i "ARM64"
    3⤵
    PID:4820
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
    3⤵
    - Executes a command shell one-liner
    PID:5288
  - - C:\Windows\System32\cmd.exe
      C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
      4⤵
      PID:3304
  - - C:\Windows\System32\cmd.exe
      cmd
      4⤵
      PID:4240
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\Downloads\MAS_AIO.cmd" "
    3⤵
    PID:5100
- - C:\Windows\System32\find.exe
    find /i "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:2352
- - C:\Windows\System32\fltMC.exe
    fltmc
    3⤵
    PID:4304
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2056
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c mode con
    3⤵
    - Executes a command shell one-liner
    PID:4452
  - - C:\Windows\System32\mode.com
      mode con
      4⤵
      PID:4736
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:3612
  - - C:\Windows\System32\PING.EXE
      ping -n 1 activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5752
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5624
  - - C:\Windows\System32\PING.EXE
      ping -n 1 updatecheck312.activated.win
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5200
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:1984
- - C:\Windows\System32\find.exe
    find /i "/S"
    3⤵
    PID:2052
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
    3⤵
    PID:2080
- - C:\Windows\System32\find.exe
    find /i "/"
    3⤵
    PID:3496
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    PID:2000
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
      4⤵
      PID:4668
- - C:\Windows\System32\mode.com
    mode 76, 34
    3⤵
    PID:5300
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:2324
- - C:\Windows\System32\find.exe
    find /i "O365"
    3⤵
    PID:5096
- - C:\Windows\System32\reg.exe
    reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds
    3⤵
    - Modifies registry key
    PID:2912
- - C:\Windows\System32\find.exe
    find /i "O365"
    3⤵
    PID:968
- - C:\Windows\System32\choice.exe
    choice /C:12345678EH0 /N
    3⤵
    PID:6044
- - C:\Windows\System32\mode.com
    mode 110, 34
    3⤵
    PID:5416
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
    3⤵
    PID:5324
- - C:\Windows\System32\find.exe
    find /i "AutoPico"
    3⤵
    PID:5332
- - C:\Windows\System32\find.exe
    find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:5292
- - C:\Windows\System32\find.exe
    find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:5340
- - C:\Windows\System32\find.exe
    find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:5320
- - C:\Windows\System32\find.exe
    find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:5420
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:4444
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
    3⤵
    PID:4792
- - C:\Windows\System32\findstr.exe
    findstr "577 225"
    3⤵
    PID:4508
- - C:\Windows\System32\cmd.exe
    cmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"
    3⤵
    - Executes a command shell one-liner
    PID:2652
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get CreationClassName /value
      4⤵
      PID:5152
- - C:\Windows\System32\find.exe
    find /i "computersystem"
    3⤵
    PID:5164
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"
    3⤵
    - Executes a command shell one-liner
    PID:2100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5188
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:5508
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn
      4⤵
      PID:3468
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3052
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST
      4⤵
      PID:2776
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4240
- - C:\Windows\System32\find.exe
    find /i "Subscription_is_activated"
    3⤵
    PID:3948
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
    3⤵
    - Executes a command shell one-liner
    PID:5556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1272
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 10 Pro" "
    3⤵
    PID:1292
- - C:\Windows\System32\find.exe
    find /i "Windows"
    3⤵
    PID:5932
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:1464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4812
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value
    3⤵
    PID:5144
- - C:\Windows\System32\findstr.exe
    findstr /i "Windows"
    3⤵
    PID:3564
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
    3⤵
    - Executes a command shell one-liner
    PID:5372
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE
      4⤵
      PID:5344
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    PID:5564
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5392
  - - C:\Windows\System32\PING.EXE
      ping -n 1 l.root-servers.net
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5124
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s
    3⤵
    PID:5440
- - C:\Windows\System32\find.exe
    find /i "AutoPico"
    3⤵
    PID:3704
- - C:\Windows\System32\find.exe
    find /i "avira.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:3892
- - C:\Windows\System32\find.exe
    find /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:3440
- - C:\Windows\System32\find.exe
    find /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:5168
- - C:\Windows\System32\find.exe
    find /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts
    3⤵
    PID:1752
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:5208
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "1056" "
    3⤵
    PID:5152
- - C:\Windows\System32\findstr.exe
    findstr "577 225"
    3⤵
    PID:4548
- - C:\Windows\System32\sc.exe
    sc query Null
    3⤵
    - Launches sc.exe
    PID:5544
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot
    3⤵
    PID:5496
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
    3⤵
    PID:3828
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState
      4⤵
      PID:5328
- - C:\Windows\System32\sc.exe
    sc start ClipSVC
    3⤵
    - Launches sc.exe
    PID:4032
- - C:\Windows\System32\sc.exe
    sc query ClipSVC
    3⤵
    - Launches sc.exe
    PID:5540
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService
    3⤵
    PID:5224
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description
    3⤵
    - Modifies registry key
    PID:780
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName
    3⤵
    - Modifies registry key
    PID:5216
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl
    3⤵
    - Modifies registry key
    PID:5156
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath
    3⤵
    - Modifies registry key
    PID:4220
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName
    3⤵
    - Modifies registry key
    PID:4160
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start
    3⤵
    PID:2772
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type
    3⤵
    - Modifies registry key
    PID:2320
- - C:\Windows\System32\sc.exe
    sc start wlidsvc
    3⤵
    - Launches sc.exe
    PID:3616
- - C:\Windows\System32\sc.exe
    sc query wlidsvc
    3⤵
    - Launches sc.exe
    PID:3320
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService
    3⤵
    - Modifies registry key
    PID:1864
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description
    3⤵
    - Modifies registry key
    PID:1596
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName
    3⤵
    - Modifies registry key
    PID:1164
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl
    3⤵
    PID:5464
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath
    3⤵
    PID:3948
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName
    3⤵
    PID:4736
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start
    3⤵
    PID:6048
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type
    3⤵
    - Modifies registry key
    PID:1556
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:3268
- - C:\Windows\System32\sc.exe
    sc query sppsvc
    3⤵
    - Launches sc.exe
    PID:5512
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService
    3⤵
    - Modifies registry key
    PID:5828
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description
    3⤵
    - Modifies registry key
    PID:5848
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName
    3⤵
    PID:4652
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl
    3⤵
    - Modifies registry key
    PID:1904
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath
    3⤵
    - Modifies registry key
    PID:4760
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName
    3⤵
    PID:1340
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start
    3⤵
    - Modifies registry key
    PID:5268
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type
    3⤵
    - Modifies registry key
    PID:396
- - C:\Windows\System32\sc.exe
    sc start KeyIso
    3⤵
    - Launches sc.exe
    PID:524
- - C:\Windows\System32\sc.exe
    sc query KeyIso
    3⤵
    - Launches sc.exe
    PID:5080
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService
    3⤵
    - Modifies registry key
    PID:3756
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description
    3⤵
    - Modifies registry key
    PID:1336
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName
    3⤵
    - Modifies registry key
    PID:3576
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl
    3⤵
    - Modifies registry key
    PID:3332
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath
    3⤵
    - Modifies registry key
    PID:4308
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName
    3⤵
    - Modifies registry key
    PID:4456
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start
    3⤵
    - Modifies registry key
    PID:4332
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type
    3⤵
    - Modifies registry key
    PID:1160
- - C:\Windows\System32\sc.exe
    sc start LicenseManager
    3⤵
    - Launches sc.exe
    PID:5096
- - C:\Windows\System32\sc.exe
    sc query LicenseManager
    3⤵
    - Launches sc.exe
    PID:4804
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService
    3⤵
    - Modifies registry key
    PID:5380
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description
    3⤵
    - Modifies registry key
    PID:8
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName
    3⤵
    - Modifies registry key
    PID:4524
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl
    3⤵
    - Modifies registry key
    PID:3792
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath
    3⤵
    - Modifies registry key
    PID:3680
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName
    3⤵
    - Modifies registry key
    PID:4268
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start
    3⤵
    - Modifies registry key
    PID:1012
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type
    3⤵
    - Modifies registry key
    PID:3692
- - C:\Windows\System32\sc.exe
    sc start Winmgmt
    3⤵
    - Launches sc.exe
    PID:3812
- - C:\Windows\System32\sc.exe
    sc query Winmgmt
    3⤵
    - Launches sc.exe
    PID:6044
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService
    3⤵
    - Modifies registry key
    PID:5316
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description
    3⤵
    - Modifies registry key
    PID:4624
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName
    3⤵
    - Modifies registry key
    PID:5240
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl
    3⤵
    - Modifies registry key
    PID:5352
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath
    3⤵
    - Modifies registry key
    PID:5416
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName
    3⤵
    - Modifies registry key
    PID:5564
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start
    3⤵
    - Modifies registry key
    PID:5432
- - C:\Windows\System32\reg.exe
    reg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type
    3⤵
    - Modifies registry key
    PID:5124
- - C:\Windows\System32\sc.exe
    sc start ClipSVC
    3⤵
    - Launches sc.exe
    PID:5420
- - C:\Windows\System32\sc.exe
    sc start wlidsvc
    3⤵
    - Launches sc.exe
    PID:2160
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:4792
- - C:\Windows\System32\sc.exe
    sc start KeyIso
    3⤵
    - Launches sc.exe
    PID:1996
- - C:\Windows\System32\sc.exe
    sc start LicenseManager
    3⤵
    - Launches sc.exe
    PID:2884
- - C:\Windows\System32\sc.exe
    sc start Winmgmt
    3⤵
    - Launches sc.exe
    PID:3500
- - C:\Windows\System32\sc.exe
    sc query ClipSVC
    3⤵
    - Launches sc.exe
    PID:1752
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:2032
- - C:\Windows\System32\sc.exe
    sc start ClipSVC
    3⤵
    - Launches sc.exe
    PID:5152
- - C:\Windows\System32\sc.exe
    sc query wlidsvc
    3⤵
    - Launches sc.exe
    PID:4548
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:4108
- - C:\Windows\System32\sc.exe
    sc start wlidsvc
    3⤵
    - Launches sc.exe
    PID:1976
- - C:\Windows\System32\sc.exe
    sc query sppsvc
    3⤵
    - Launches sc.exe
    PID:5272
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:5328
- - C:\Windows\System32\sc.exe
    sc start sppsvc
    3⤵
    - Launches sc.exe
    PID:2076
- - C:\Windows\System32\sc.exe
    sc query KeyIso
    3⤵
    - Launches sc.exe
    PID:5212
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:5408
- - C:\Windows\System32\sc.exe
    sc start KeyIso
    3⤵
    - Launches sc.exe
    PID:4128
- - C:\Windows\System32\sc.exe
    sc query LicenseManager
    3⤵
    - Launches sc.exe
    PID:5216
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:3304
- - C:\Windows\System32\sc.exe
    sc start LicenseManager
    3⤵
    - Launches sc.exe
    PID:4220
- - C:\Windows\System32\sc.exe
    sc query Winmgmt
    3⤵
    - Launches sc.exe
    PID:4612
- - C:\Windows\System32\find.exe
    find /i "RUNNING"
    3⤵
    PID:4764
- - C:\Windows\System32\sc.exe
    sc start Winmgmt
    3⤵
    - Launches sc.exe
    PID:1724
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_ComputerSystem get CreationClassName /value
    3⤵
    PID:4992
- - C:\Windows\System32\find.exe
    find /i "computersystem"
    3⤵
    PID:3616
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingService get Version
    3⤵
    PID:5492
- - C:\Windows\System32\cmd.exe
    cmd /c exit /b 0
    3⤵
    - Executes a command shell one-liner
    PID:5676
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "0" "
    3⤵
    PID:5116
- - C:\Windows\System32\findstr.exe
    findstr /i "0x800410 0x800440 0x80131501"
    3⤵
    PID:4176
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d
    3⤵
    PID:5952
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:3268
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore
      4⤵
      PID:5512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
    3⤵
    PID:5828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
    3⤵
    PID:4604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3324
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
    3⤵
    PID:5204
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"
    3⤵
    PID:3316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"
    3⤵
    PID:2052
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:5128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"
      4⤵
      PID:3564
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"
    3⤵
    PID:5440
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"
    3⤵
    PID:2160
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4792
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE
      4⤵
      PID:5168
- - C:\Windows\System32\reg.exe
    reg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"
    3⤵
    PID:1752
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1424
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE
      4⤵
      PID:5152
- - C:\Windows\System32\sc.exe
    sc query wlms
    3⤵
    - Launches sc.exe
    PID:1976
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"
    3⤵
    PID:4032
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"
    3⤵
    PID:5540
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"
    3⤵
    PID:5188
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"
    3⤵
    PID:5396
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:2280
  - - C:\Windows\System32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"
      4⤵
      PID:5412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"
    3⤵
    PID:4192
- - C:\Windows\System32\findstr.exe
    findstr /i "KMS_"
    3⤵
    PID:3304
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:1036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"
      4⤵
      PID:3948
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "
    3⤵
    PID:1340
- - C:\Windows\System32\find.exe
    find /i "Ready"
    3⤵
    PID:5300
- - C:\Windows\System32\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f
    3⤵
    PID:1272
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"
    3⤵
    PID:5748
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "
    3⤵
    PID:2900
- - C:\Windows\System32\findstr.exe
    findstr /i "Removed Not Found"
    3⤵
    PID:3620
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul
    3⤵
    PID:3576
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE
      4⤵
      PID:1336
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 0ad2ac98-7bb9-4201-8d92-312299201369 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5 221a02da-e2a1-4b75-864c-0a4410a33fdf 291ece0e-9c38-40ca-a9e1-32cc7ec19507 2936d1d2-913a-4542-b54e-ce5a602a2a38 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 3502365a-f88a-4ba4-822a-5769d3073b65 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 60b3ec1b-9545-4921-821f-311b129dd6f6 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 6365275e-368d-46ca-a0ef-fc0404119333 721f9237-9341-4453-a661-09e8baa6cca5 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 82bbc092-bc50-4e16-8e18-b74fc486aec3 8ab9bdd1-1f67-4997-82d9-8878520837d9 8b351c9c-f398-4515-9900-09df49427262 90da7373-1c51-430b-bf26-c97e9c5cdc31 95dca82f-385d-4d39-b85b-5c73fa285d6f a48938aa-62fa-4966-9d44-9f04da3f72f2 b0773a15-df3a-4312-9ad2-83d69648e356 b4bfe195-541e-4e64-ad23-6177f19e395e b68e61d2-68ca-4757-be45-0cc2f3e68eee bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 df96023b-dcd9-4be2-afa0-c6c871159ebe e0c42288-980c-4788-a014-c080d2e1926e e4db50ea-bda1-4566-b047-0ca50abc6f07 e558417a-5123-4f6f-91e7-385c1c7ca9d4 e7a950a2-e548-4f10-bf16-02ec848e0643 eb6d346f-1c60-4643-b960-40ec31596c45 ec868e65-fadf-4759-b23e-93fe37f2cc29 ef51e000-2659-4f25-8345-3de70a9cf4c4 f7af7d09-40e4-419c-a49b-eae366689ebd fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab fe74f55b-0338-41d6-b267-4a201abe7285 " "
    3⤵
    PID:708
- - C:\Windows\System32\find.exe
    find /i "4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c"
    3⤵
    PID:616
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="VK7JG-NPHTM-C97JM-9MPGT-3V66T"
    3⤵
    PID:3332
- - C:\Windows\System32\cmd.exe
    cmd /c exit /b 0
    3⤵
    - Executes a command shell one-liner
    PID:5264
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus
    3⤵
    PID:5232
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul
    3⤵
    - Executes a command shell one-liner
    PID:4360
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Control Panel\International\Geo" /v Name
      4⤵
      PID:1140
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul
    3⤵
    PID:2236
  - - C:\Windows\System32\reg.exe
      reg query "HKCU\Control Panel\International\Geo" /v Nation
      4⤵
      PID:3324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\Downloads\MAS_AIO.cmd') -split ':sign\:.*';. ([scriptblock]::Create($f[1]))"
    3⤵
    PID:5204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service ClipSVC } | Wait-Job -Timeout 20 | Out-Null"
    3⤵
    PID:4848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5124
- - C:\Windows\System32\ClipUp.exe
    clipup -v -o
    3⤵
    PID:4992
  - - C:\Windows\System32\clipup.exe
      clipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\temDCA6.tmp
      4⤵
      Checks SCSI registry key(s)
      PID:5100
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"
    3⤵
    - Executes a command shell one-liner
    PID:6048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5116
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /S /D /c" echo "Windows 10 Pro" "
    3⤵
    PID:5200
- - C:\Windows\System32\find.exe
    find /i "Windows"
    3⤵
    PID:1904
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate
    3⤵
    PID:5828
- C:\Windows\System32\reg.exe
  reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:780

C:\Windows\system32\Clipup.exe
"C:\Windows\system32\Clipup.exe" -o
1⤵
PID:5396
- C:\Windows\system32\Clipup.exe
  "C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\TEMP\temDBDA.tmp
  2⤵
  - Checks SCSI registry key(s)
  PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5548_679808390\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

GenuineTicket.xml

Path C:\ProgramData\Microsoft\Windows\ClipSVC\GenuineTicket\GenuineTicket.xml
Size 1KB
SHA256 5cf3ae9ca793d9a8517d05864eacca525ae8b4db3d13943edcc4bf3f2131dab4
MD5 5e22ef25ec6bdbe63cedfbdf75011316
SHA1 d828c721daf6c630960838dd3a9391d2ec62e88f
SHA512 8599d461fbe166906bc42d2ac6235d32a0f32ea247dbf1bad76ca72233df7b5907c7ebb57b943a3e51d0dae8825baca396f2dd79a34b00197f9dcaa8d6a37714
TLSH
T1381123B4D5356C10221C67F086713BD3BB1C314BC6935D29FB41579835AA2823B57029
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2deec6a95ec52614194a78a23d73e7d01a237bb1c36f177b2d079e01904bbb02
MD5 1a081c1a44490c52836d469b86ac0024
SHA1 afd36b8efece8f0b6da93e52448b0b0b92b7f2e0
SHA512 19264593eac6e8fc2b1fc661bfd6a9ea2c8b80318a9fd4358c9f04722074d457d449cbd4766b079f4cbed4f9218c79e4304ea56aee93a1d3484cb9deae7c7b51
TLSH
T1F8D02320763CFCC1C628117191218F007B355452315BD14AF2558C1D5CB50C197D6BD1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6510ff17fa61d14dadac16d99faa2e8d46511259b03c87b11eea360b3bd0acca
MD5 449ebde127d266cf4254ba946d81f622
SHA1 95395fce0c6cc52cf04ebdd71f5804faabfa0ad2
SHA512 24a50bd1d7d4d94fbe6d40830148ce021973a2c5e1dc30202b34c397a5873a5ad2239137d6f23e1e0a8a02568c3aaf124b2b6555e22b2f7a7e9e71c7205d5f98
TLSH
T15FD023707778FC41C70631707111CF517B626191311FD456D170441D5CB51D547CE2C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da2359d211c3f3a004a108ae906a93efdefbc66b22da98ed010bf60ddd8e874f
MD5 6e9bf87c57d291288b215dbc5416c976
SHA1 1812ec9dcedd9f656df4f452817b6a185ccf4706
SHA512 f9c165bd76bc4f2f5148778c29786157808a512278f2ff62f9ce09b56685f7adb38e02b1961b5051c68aebedea08dcea00eed8efbc64a89b08d225eab4814074
TLSH
T1CED023707B78FC41C7063170B510CF517B6261D1311FD456D174441D5CB51D547CE2C1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f607d0ccc7875d6993fa3f9a53af3affebbb3ab3838d17e41a37152bce2a692c
MD5 9f9425418effb34131be5461d469caf0
SHA1 35f190a0aafae20e0d438ce7a52af2bf20843f46
SHA512 3552ab7964345fc4baf59d67444e15a0cba438d34322f6cdf1f814086c91268285721fb1ebf1f9a15c4b868eb0ec75233efb0cc53b6f1b46cefe8e4d9cb6a086
TLSH
T16B71720DC952D941F7AE277DFCD1A29536F280D44DF39E8A367018BC7617BA290F9408
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 067d78c94b492075e06ec00eaacd37dc57627ffea086e297212f07139b603257
MD5 c483b4de7fcf86f4fc2ff7251001bab8
SHA1 409a92493b123ad625638868312f34330c1a8216
SHA512 4cf9ab086a4f0c08cbf0fdab07018e2ecc37f877dad5275d7232a13c10c4df9e00d47e13819aa60ee420c2b8affc1272cdcaefb6ba819f95fcafa2e7988163c0
SSDEEP 3:MsEllllkEthXllkl2zE/lvlt:/M/xT02zqt
TLSH
T139440205AB801807C5442135805183902375D43047125783346204336C856400D04100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 319B
SHA256 09e2fbb115ef06c9241ef1946cc70f2d5354c82962d365042e8075213ce0136d
MD5 ce28b837cd90b9438407fbd755a71701
SHA1 09e1a4ac13f40a96b6b3fdf7c5fbba0dcc36542e
SHA512 5b8b0dbe8331efecb847e226191a81f7fb36e60531f00ee52d784d989a26a5e886c63c733783b9e45817fbce5d6c10758422cc44fb453bf09f5be3b9aa519783
TLSH
T172E0262815C8C229E554F8D38A6C6348D2D034CAAB8839036B8C8840A101E4AA3B6A9C
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 24KB
SHA256 2fecbd3197137c71299fdfd6311ccbdb0a81cf028125864983f86b4d0af54b90
MD5 714c2c84962d4c90943747e43bf63f25
SHA1 96c35600030ca2e9951fef22f0a1e074ca055c60
SHA512 30de111f437e63b516fc4e4c7a498eab5b1bde6be0552d5135e8d43fc21b5aa2849c643ce8b905366ede182f2aa5ad9437effb508fece5a91fde82cc0adc8b3b
SSDEEP 96:UBCxfNgnNYpd36hRjxq+Em/+MJuuw2SKkHVXuiqrpy:GafNgnNYpdK8vTHL9ubr0
TLSH
T1B8B20987AE753602E7520A3B355E587DC97FC06EAFF69D8034A46C221CFD40151B86EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 47240e2b20486b3c39be43ec7e61f23696adf0037915ccc61b34ed06b8d1469c
MD5 14ef4de5b1bf4d8aab90344b65508cd3
SHA1 b7c7be00cbc70872698fafa3a037938d68c279e5
SHA512 c54db2178fc04c4c9d2217d2f1ea9934221a859686ae183ba8725cd7227b768c12dfbe8f4c816e1bfc651d0e525f09b6152265e1a71ce71e794ec8a50ce5e2ad
SSDEEP 192:SzNzc9YQzvzhf+G83uy3Ct7XBBKkv6H7DXspU3iD:2Fc9Yg/83uICtTBBe7DXspU3iD
TLSH
T16314434E4F243321CD7D527669EB44A35D7DF03F8B12668A6C611474CEE3B52A42C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 19B
SHA256 ab5c71347d95f319781df230012713c7819ac0d69373e8c9a7302cae3f9a04b7
MD5 0407b455f23e3655661ba46a574cfca4
SHA1 855cb7cc8eac30458b4207614d046cb09ee3a591
SHA512 3020f7c87dc5201589fa43e03b1591ed8beb64523b37eb3736557f3ab7d654980fb42284115a69d91de44204cefab751b60466c0ef677608467de43d41bfb939
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 334B
SHA256 3917bd3ac037838466ff289717b8ff63f328572dffa541e2954b9c38817589ca
MD5 21937cedaf2a7bad418a6dd30f5c7413
SHA1 aec7352df6ac0340fdbb5007490a3bafa1ccdc9a
SHA512 324803210f834e1548e3d8be7e7b7906a27c595375411e5d918077d722b5c90dd68632bc0e24ad3007153b257b2927ac8a5875b90fce7bfab8e2437906f620e3
TLSH
T1BFE0207086CDC16D6A4474CB462C770CD7B0348EE7883E076F5C9C50B441404ABB16DB
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5eacde9c5e93b4ce2acfac49813c14b8c3b981b2a7e54f567b2d4a32991c2826
MD5 450595d2128c0a7daf086b2bef4b6a55
SHA1 4cb16ad7ca95c4df9648a39da29b45d209ec4c14
SHA512 07527516741a196af8db1a7b53c0f507a16812287a5ae634b72188888de1f3afb0a4412ef37d3683aeee6b999fbc7fd9c65f358909f8efd489609728c1dc0692
TLSH
T1CA31AEF3C2E8866D890152F4B7187F1BCE1D0954532C3D9BC8E4AF1B93E2875D14055E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c434517dc12a06aea7bdd29fb36d3e4ab74953ecf5d7094fe587350da6761419
MD5 418eff8101b7e1cefa82cc03ebc2775a
SHA1 143e7703d515365d20bc2a4b3363f6765f7a3373
SHA512 4f8e6d6bf82a448dd847e8d47b72522989bf7164f852bc8dd0e1974b93eaa578abbf44b12153bb6a71e5f3abc54b95c9445abe8ed990cce4e7f8d8770034c49f
TLSH
T171419DF7C3E4C5AEC94156F0AA38AE2BCF2E0519532CBC15C9D4EE5B93E2461E10164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ce7042bceb9ab030e97e293ee5f5879a4341251cdef3890a170c2dc59321ea65
MD5 fa4aa90c7630938309a12c6b613d39d8
SHA1 343a1262e0436a5c6671a4a825f101006bfdded9
SHA512 3d86b3ac05daa81c43cbcf9e8bddc37bf6578539ff34094e469dd14e9d2df20488ea3919472f01fd9ff7549a4c77568b9949c3531286ea4d28d02c69fbe84c98
TLSH
T102419DF7C3E4C5AEC94156F0AA38AE2BCF2E0519532CBC15C9D4EE5B93E2461E10164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9c58a523e7ea158bdb8474d4ef6e2eb1e454f156726c110be859bac7eda2a136
MD5 da44e2a54b561c021bba99b98542d78f
SHA1 2d01b52be39b0ec250ea7b21abfe9f9333c1c5b6
SHA512 319bb1551e59e5934a597fa4e74e28f11f4c4daf774710f93fb4cf51d711a819210fca05eb016907bf2f72ebd15b33668e13184b712e9910715807c7f3f32e27
SSDEEP 192:sxZqRZkV/fks465IdpY21HW6+WNYVSB/YLzX7/IgrJ:sxZq8V/fks46S1HbD/09
TLSH
T11022B9166E78A93B4CCBD209BB15BF53E6F95032D5941E48B6FC860C04EAADD630780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e6c6e6a1b3759a2777565909f17e9b26f82337e38bddc12d848c501624289ff9
MD5 c308ba554a5af093832f5f6e9be09847
SHA1 66801d894357666b2cff24d654afc6c7fa7e95fc
SHA512 ede573adb06db36a684e540c3167d420b2bf5d6534510772b1e8e2f5169a370fbc1859a4a6fe9cabd014ff4ba8321a2e0cf17ca471867c687c95916e9b9d169b
SSDEEP 192:sxZqRN9V/fksYWpVoOSIdpS21HW6+WNYyEkVdrXYLAtl1IgbcJ:sxZqxV/fksYWvoObrHbKCXV8
TLSH
T1FC42CB16A974697B9CCBE21DBB15BF23E6F94032D1915E44A6FC8A0C04EB6DD630780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 01e3d4ad6ff878a9583ab7d74b115fe7acb9f820960c4fb37bb0df5ed9de284b
MD5 9c20b20aca6402ae6375afd00dd59049
SHA1 8cdb1172aa628c9b56066d432a08e7fb17e64c8d
SHA512 b5d21a03ad3d0495bdff09c232e49f4ca13db5bda31d723cbb41a6187b99fc36d5a8a2bc787065bf54f304c6ef74bb1aa0ea32407f23c39bf316b7aa98b88045
SSDEEP 192:sxZqRN9V/fksYWpV0OSIdpS21HW6+WNYyEkVdrXYLAt+WzIgbcJ:sxZqxV/fksYWv0ObrHbKCX0Y8
TLSH
T1CE42BA16A974697F5CCBE21DBB15BF23D6F94032D1915E48A6FC8A0C04EB6DE630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 adf54e29267fa1e1413e80a9ab86b35a96d3e3ae600a826cdd3852af60708aec
MD5 473e94f512a5b36e4156ab97138a220f
SHA1 449ca428d07bc0179e40700ca0f3da43ce2050f0
SHA512 707ca78629deef907fa98378117f66d410e3ebd29185656469078fb9b52a6beb55b954154e33c5dfb758e1812a7d3b753131e14e2d16d053b6f94ed02a2b0828
SSDEEP 192:sxZqRZkV/fksm65IdpY21HW6+WNYVSB/YLzX7/Ig52J:sxZq8V/fksm6S1HbD/0g
TLSH
T18E22B9566E78697B4CCBD20ABB15BF53E6F95032D1941E88B6FC860C04EA6DD630780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8dd5705523041fe23ff5c0319d35bf70152d23dda09a3cbf491692c380ef1c6e
MD5 a1ba7653d5721ce4bf09ebca145a8ed1
SHA1 85e7882b7c228d1c0ef0f2b339c9c91d3c50fd88
SHA512 3ce803fe50d1e75cad8503ae1bd8bc73ee299ed39e40bafe5e48a4abbe37e2ee1889d4958fcee6d079ad47b24be072434916c1266785889da8a16e50fffd9cda
SSDEEP 192:sxZqRN9V/fksNWpV0OjBIdpS21HW6+WNYyEkVdrXYLAt+P/IgbLJ:sxZqxV/fksNWv0OmrHbKCX0nB
TLSH
T10152D916A974593B5CCBE21DBA15BF23D6F95032D1905E48A6FC8A0C00EBBDE630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b4d531c75ae023f2d11109e0803345777068ba8c942386b52b47e1b8a0159d10
MD5 a2d18c182f95a3333f909c2a27533a00
SHA1 7df7471496151043dd0578be83ec4b71f5ebf170
SHA512 687412d94bf1fda559df5c96fda12802ec7e093dfa05852201455777e7fdf3528597ef76875d2652c8f01a560e64ddd66431ae505e8d467b52c5081370db652d
SSDEEP 192:sxZqRZkV/fksmO5IdpY21HW6+WNYVSB/YL7J7/Ig5cJ:sxZq8V/fksmOS1HbD/A6
TLSH
T1D132B9566E74697B5CCBE209BB15BF53E6F54032D1941E48B6FCC60C04EAADD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e35b0670a608fd7bbf50b3489533e306af3fd97e851c8ccd1db7da238d808a1f
MD5 577259526dacdcc6ff4c5184d249d9bc
SHA1 eba231669389f552e61b00045405d9d67a71385c
SHA512 dc86b69833950101834a4e922ac3632518d62b103e6812d0aac35cab5533ac7080340830a3760c2a30f99525c040f098f95b19df057bdb819adec53959543bf5
SSDEEP 192:sxZqRZ9V/fksmO5IdpY21HW6+WNYVdrXYLwJ7/Ig5cJ:sxZqFV/fksmOS1HbuXT6
TLSH
T1C332B856AE74697B5CCBE209BB15BF53E6F54032D1911E88B6FC860C04EAACD630780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 261a81db1c6ad6bb1892da1c64c508e25dd8967693709083fbe845f679318c23
MD5 5c939311e6b30489215d4463cc58d1c0
SHA1 20c99aa4fc74de23c37c1dc792eb049d84a1869f
SHA512 7e9b3af2d991725aacf1bfa848a89a43b62c506fda260b1f077141227a5467af18180d129689e46a46a89e35907f3bae935bc15583d815f395287d45aa842437
SSDEEP 768:uxO6fP1Wvxz3j8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkILlWwJvBrom3M:uxO6fP1Wvxz3ju1jaZILIsv6WM
TLSH
T130C2E83B640DCB7E4F801A9DAC5A6F973E9802C7AB588D8447FE854C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 4b83bc12e7efec227cb914f4129e6f05de9485b3f274b6550c65b437d6ea968e
MD5 aec1166e0b547539bd981dfc30cf9b10
SHA1 4290c568d5ef1e80ef42414e6f329b8d4ac94b27
SHA512 e3fd0a02d37c091754ee6a9be8bd1b66ce150eecffc861212fcda5aecfde9d825a3dbede3abb116ca8bf7b4b13601113d7889e12713eb4f9eb99e0a58daee48d
TLSH
T158E04F6006C9C5BB645760C30268930CE2EAB41FD6EA3D13AF988D946547944B7E358A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 1dad52d7f4acc94f6dee9f8463bf2f21e848983eb89147be44aa9899d29c82c1
MD5 0122e1eee5d65aca8f33267a00d1b1e6
SHA1 45f9ca30e8eab3ebdbccd4646c7bd0b683734c88
SHA512 3c9a888b9c341556c5d2813688f0985b8f536af3b6bb4468a7d3c0a1bb7d4a21478483ec29ac225a5bd7cd388e5a706e836f58b95b363aecb73c45f9c2170494
TLSH
T158B012083F009A52C0C9553001988749E2A0F00313409413CC9CDF142D0A7ED6E06ED2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 347B
SHA256 d69033997dbe401b4d3059e9b9268a4d0d6bc570bc5bc9e111b4d61d0e733086
MD5 11afc6472822ecd596868793e9505589
SHA1 1ecda38cd8e89f4fde55da3295d8f9c433bd63a0
SHA512 07cc0f9b9912ede75adf8408841abd27ad735d51f9b305411ebd0b0ccc30655949c12d580083fe003ab16ee62687bc00490cdbd55cae77d9a0d6a5e4a29bfacc
TLSH
T188E0D83416C9C62BB6C620C7822DE34CD1A27446D7D93912BB5C9540620B544B353944
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 323B
SHA256 da91809871ed6bf61de68d959f24b3a68d15cb04733580ebc2e747699d5b8a9a
MD5 de860bc0684a8240f4bdf1c1b5a6b0e8
SHA1 6e176fd2d107ba97936528617db87efbbbd54c52
SHA512 f3efd78b324e932bf7de9ffe496e609e6e46fbbf2011ad5cba5f5a992b1c63e7ec96eaa51badf0dfea2a6b2006cee7f55287111b8307149e4d5517ea6e6dabd7
TLSH
T175E0267447C8C63AA54074C3426CA74DD2F0784B93C83B03E74C4440B502910B3B6DC8
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 f96937442b2a15b4f2c0ea9fcb806c3a6167fd082f4ccf864b922892ff1ba983
MD5 ae5a74d682a82435b5181cfcbe418cc9
SHA1 e4ee4c65b24dbeafa475c930ad2423e6ed1e7f5d
SHA512 131b97af809eb1a095d11439f5c0da72f5f70f41ace48567e04a7bd30efa6214fbb923f387bafcb4636f52b84dab53c8e291a1a4122b61222f04c7b995fbc29a
SSDEEP 96:KUAAKtePGbGKYcaG5CKSMt5iKqgS+VWKGkm:iiJt5DpB7
TLSH
T1C5E1F11271BF06072DBE2A08A39487274742B163702EA52B3BE950714E6BE354DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a81b88f8-8936-4a43-a441-af3cfe30c461.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a81b88f8-8936-4a43-a441-af3cfe30c461.tmp
Size 414B
SHA256 3903eb8c4165cce56bead5ead20670ec0d7c5142422111b2a8d99b8acb5c3167
MD5 40c68c79d944b60b0c55ecb7b2769b1b
SHA1 041cee650b9d0b2e85741db8028c9c56f8be4169
SHA512 8759e3e23376bd24e78305e4ac6ec73e61cb1cb18a1a4ff7e0a5fff604424fd77da53e352e39f4c172ca21b2472cfc22138513fa3800729f600aa55ae43ddb5a
TLSH
T152E02BEAC825DD6B1CFD171A64544F46F70617171791580F363D810DCF7463A468583C
MD5 SHA1 SHA512 TLSH

Submit Download

fe267b5f-05f3-4b4e-9256-4b530d3eb33e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe267b5f-05f3-4b4e-9256-4b530d3eb33e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 15KB
SHA256 66546c495479300f985db2e255af4e20ffedbc06a74a613fad0f30bd6c3250fd
MD5 d3768ec06cd9a21cd730c336933ee8d3
SHA1 cd1dddebac2a44f5802cdf1a6d680f958d0a9ca4
SHA512 90ab1b11bc336ddcde160b4920fd4a2219cac8984075575298ba51fa507859a19999541aaa783ab40f7854fc65279e07c9c684c24d7fc2bb56500d1adf79bd40
SSDEEP 192:uQXIIImbGMIMslYcYPQOGcAsIlrhBCsl7Evez8zRtkz8zVJ5z8zlJ5z8zj:uQXIIImbGMIMuBgGFsqOsevVtLJkJq
TLSH
T17462935ACA0897B7C21F2F7B57A6C65916E588C31861521C30603C4E8EF3AA78ED57F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 e1135c1c3b5d49022578ad1773b2b10881f27f707722888f9b403e59d39f1341
MD5 5040a6a4f44e0130044991c51fc2e4ee
SHA1 5858eb50a836d1c1071daacd21264b1527c3788c
SHA512 5c080edee456d649e062c8772951c3766f1ed59ade606f8461064418d454721f2a898ea022ea7379335fa29dbbfd19b51fa14d854d45a60a9f2beb9eb1626e69
TLSH
T188E020205DC4C15E755530CB451C530CD385344FEA842A07BF9CCCC4750194077F5566
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 503c397c8451b6c6e4739262ee6641be9b86de9a8f89e3168b21049d550a53f5
MD5 a461ca1a0370bbc6822cd793e597a3a7
SHA1 a131ebd6e1f283942f8e13061fa3079569e2514a
SHA512 ee606d082aa66c3b08a4dc55e8a12a75448948171ebf032bc0cc43b7961ed2b903be81eae944e8292cafd1e68069700324b82e442adab925f7bad134d8b087e4
TLSH
T1E0216896F338C149D2498A3A143E67250374D812CFFCEC0F05BA20243E73E410E4B2EA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 bfd0d23502b3782007f7d128e70d5a0ca36430c3e81dd2228c68d8ea88a7f1cb
MD5 47129eab4ff5eb2326bc051911779d36
SHA1 d1edbbc92fb78116ae316a130bcbb4d33bb7df4c
SHA512 f24024d8e67b124479175310f1bf8c479f91165adaecc2394ef8b1270959410a5d842ecd1b3d5715853a1f72dea6239a7c0caa7cbe1fbcc4f0a748aa8f143095
TLSH
T16DE0D8206DC4C15F615130C7456C934CD296384BEA842F02BF988C84660198177A6566
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5adf84.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5adf84.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f67613920581b9cf20afbdcb57291de8b017f01c7fcfa55d17902bdd6ccf91b7
MD5 67ba97e29dbe954eee2d52f64c5363f5
SHA1 c673e7b9863d0f51182248c2e0884c94b4b60bfb
SHA512 b3485c4c78fc5bf96a13193aa905215414c71171723d5814987fcfe71525f3c4012213d54130b5aacb6b6707aae976f314a139fcea31b27f6eb840242cc939fa
SSDEEP 384:6tNn/s3n9SfsNDbrZvruO8a9LOdlzrGeFOObjI9G6w73U0:6j+9U+pl9O3zrGeF29Md
TLSH
T1EE929E32AC289D7B5EA35555F54B3B174FB8017FC68A2E84E1ECAF0C01DF6AC531A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 41e3ac75429a82ecbf154734e66bed278175e40de4f2c495c7f6b05dd786a89e
MD5 37859422a016c805d4e3301e9cceeb39
SHA1 5f276a0a407038ce91618f2bbacb094b6bff1600
SHA512 fc9d0b995b4d4d571828a476f129853f564fd9765e881a5d38e0e993318defaea0676756fd8057d3e46de63e0703c11d5bd9c02c2d8fcc310d40ad42302ea6fd
SSDEEP 384:ctNn/s3n9SeLsNOWrZvtjiiN2a9LOdlzX5MvKASBhgdwU9UylOObjI9G6w73U0:cj+9F81pN39O3zXstS/U9Us29Md
TLSH
T16BD25BE598D71DB6C59D97C3673EAE161ABCC03BB1491948B3E4AA2CEC8B5BFC311401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6f19fc648ceda6c143163cf7fb569a4938f4c89ac40d89dc07e512097ac03476
MD5 b2b5affcf81d09d2d24215910f5a760b
SHA1 4f18995bbfd5c32f8b635e2e3fb0701ecc528317
SHA512 47b4e0e697e6cc19c721374aa9c34ef3f28419355743cc8a892c4f860612a076fcdc006bbcc97b0eb5ce2cbf078c46f8185b11210c918ed5dc48f127e5bf42f1
SSDEEP 384:ItNn/s3n9SfsNDSrZvruO8a9LOdlzrGeFOObjI9G6w73U0:Ij+9U1pl9O3zrGeF29Md
TLSH
T155929E32AC289D7B5EA35555F54B3B174FB8017FC68A2E84E1ECAF0C01DF6AC531A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 482374083226d553e6149227043f49163020c38c02fce0a6a6761674411ba63a
MD5 62fb0859acddf65d168220d73f55b467
SHA1 39be681f788b9c48c911f26f3e897553af302f9d
SHA512 fe37a4f6c1913c4867016d350e615fa29aa46c7b54243e59baf844e9eac048c92999800dcab8c254ee8bb6bd21edc265f570bdbde69b56af0c2f340c6c06e65c
SSDEEP 384:nwtNn/s3n9SeLsNyUWrZvtjiXN2a9LOdlzhoAOObjI9G6w73UTHA/7Izz:wj+9FR1KN39O3zhz29Mw
TLSH
T1C2C216F568EB5CB2C99E5707A77E2E176EBCC02BB1851940B3E84A0DCC8627FD306416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d943920b04b66186a8a7a59e58788d2f4c697d71ffbc7e7a9e1f2c87353676ac
MD5 071d1faf2cc4cc2d1a80470915855d41
SHA1 676ffd324e02173630733651ec3755852fc555b4
SHA512 2629ac53be82d467e81ac4f8397e30a1b3f2f8c0953ecbf1a04de6bcf2615a2878919bd271a733e8742c4d54398afa5c308789db8421d45554233f739f309f10
SSDEEP 384:nKiF0tNn/s3n9SeLsNO8TUNTUlIUWrZvtjiaN29Df0K9LOdSgDfAEqh3kUObjI99:BF0j+9F1wgN1HNJK9OkeIEqh3ko9Mw
TLSH
T142E290F598D789B6D8AE8783673D6E065EBCC167B1881884B7E46D0CDC8B1BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8a9f6646dfd86f9614acaa72186526790cbc37e032f5cd0dfd649eb6ea9ff5a3
MD5 1f85df7b16f1e37b7513b881b498084b
SHA1 751c52c4608bc51bca9dc1a50c4ad99edfcca6df
SHA512 997a3ef33fcc9d58e818c03d293902f41240fb77de722ee5f90a7ccc12145ebbc6fb761355844b02a8e196be5de076073812912f31bb127101a897b654303cf3
SSDEEP 192:qONC6O7+3hQmiUyRjGttb0CO2bCygGOuU6:qONC61uGt9LOdkFU6
TLSH
T1AB02E7357C6C6CB79EB2AE45F68727135FA5107BE9962F80D6E81E0C00DB65C2347827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1e27ee50a2bbfaf5ec91c948f5809a92109d8d2fef48b4c4774fa205322de246
MD5 7845bedcf2420b680fa8c453bf385b88
SHA1 76b64a978901f7ded6dee1d4739f31463193d15a
SHA512 9e284a67793af37abd8fbf52be70db6faa74689a47c3b545e0c2212e0c1603d6568d56839ba5f105bcb928fdb251b46c77d99983dcd3cdd73d878fd1903e3ec7
SSDEEP 384:TtNn/s3n9S/sNDWrZv/uAN2a9LOdlzrGeFOObjI9G6w73U0:Tj+9ExnN39O3zrGeF29Md
TLSH
T1E9929E32AC689D7B5DA35555F5473B178FB4406BC6CA2F84E1ECAF0C01CF6AC531A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0b229fd5f9d03222e6861d71b89d5a5aabfe494a1009d925663e90b74e5a832a
MD5 ca21c454e6a0304f5584f3db038e3484
SHA1 29323151a673094ad90bfd5e15c6d5c977aa472e
SHA512 976990129c70f50845aff6f258e806b40bf382ac565c9047be53b57244c32409db62aa3bb0f9a25089d0761f4a83ae1cf25d740841753127879a13feaac57ded
SSDEEP 192:HONO6O7+3EQmiUy+bjsttb0CO2bClwELcNqrq0DeFU6:HONO6yjvst9LOdlzwGeFU6
TLSH
T1A0120A36787CAC7B5EA2A545F58736135FA9012BDE8A2F80D5DC2E0C01DF6AC234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 b4ee2c7832ce7127b29b2a47ea3c6fa03f4fe8430130e816269d0ea8685b4470
MD5 1dfa6c771d9cc562c309dd329cf70498
SHA1 c346adaab56bbeddd425fc5340766ffb82539c08
SHA512 52090d65a9c763f63e5ccf46d534509406e4cc96ec5ea186c4be3ec1475b9eb16e4399c1c92039c70f16396a2f8a1f88d2fb7fe6fe450255ac724241a78d7876
SSDEEP 384:ctNn/s3n9SeLsNOWrZvtjjiN2a9LOdlzX5MvKASBhgdwU9UylOObjI9G6w73U0:cj+9F81SN39O3zXstS/U9Us29Md
TLSH
T197D25BE598D71DB6C59D97C3673EAE161ABCC03BB1491948B3E4AA2CEC8B5BFC311401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 597c4d6e11d46720129498414e4ecd7c4d82083ebb376f1d136d48c2cf8f2344
MD5 c7b9e8f1beadf54ac1adc793e55772a3
SHA1 3d51cf005321ca46188cf97de53609f8a977a4c7
SHA512 e68fd9d8ce2e75e90dec9df159efc61ecec449cfb6ca710336dcc7e4182c2e10710061fcba5d59a61061f515f6b061181d6cbd0655fd89132d62a7ec3c17ec75
SSDEEP 384:otNn/s3n9SeLsNDWrZv/ucN2a9LOdlzyGeFOObjI9G6w73U0:oj+9hxbN39O3zyGeF29Md
TLSH
T1A4C217F668EB5C36D99E5343B77E2E174EBCC02BB6851A40B3985A0CCDCA67FD206405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 7d0eabc6b309a85aa7fcc1889aa6c215376db8d9925449be529d853c8eb11925
MD5 8d32c3a5436330d37ff28da9c89b1160
SHA1 b76214228dfc4b13092bb9507e793935c9a6d6a1
SHA512 6e68f961085587a2d5d31f07d85f4a738a5218e8bd7f31a969cd646e77546f1b7f71155e311b00a2cc4b33d0cf1fe2d93f521647c71a1572bb865f5794f264ac
SSDEEP 3:MsEllllkEthXllkl2zE/lle:/M/xT02zQe
TLSH
T1EB440209AB841C16C54421314051C35423B6D41006925B43346104339C856400C00015
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

c718d00b-47b1-4d88-ad41-e5daef6e4aea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c718d00b-47b1-4d88-ad41-e5daef6e4aea.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a035ea00008153af4cea22251bd825f019743c8b4b05370163c6b99c40a55203
MD5 978932e91ae9bfb9bde18828db1595cc
SHA1 ad682826c0a0146b4e86ed577144ff68cf97a5bf
SHA512 de26f663ec530698dd270330827cb260c832001d6a58e56b92dde26ae1cfaf650310b81b4687bfb42486fe987647bc40d540cca919080a8c0f25e1d03a7f0bc1
TLSH
T18041275CA6E91108B3B76E5A9FF6A86D487EBD772F06945E00110E4F0A76A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download