145d4ac628495ce01eccf5102f30da499460d77b300328b3d6aa90ddc9f980fc

Analysis

max time kernel
30s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_3163a0dcd552b4942ed0a04794dd4a77_conti.exe
Size 538KB
Sample260804-jnv9cavanc
SHA256 145d4ac628495ce01eccf5102f30da499460d77b300328b3d6aa90ddc9f980fc
MD5 3163a0dcd552b4942ed0a04794dd4a77
SHA1 07a3a734a846e52ef7cd2748a065c509cd7593c2
SHA512 45c56418eafe7a43266a171eab1a79bfa4420214b10c279544a280f24b64375a84d2fe6c8af04deb8b1eb46294905a6618080a60df6d910feb4997f3770ddb54
SSDEEP 6144:6Nd8uVnIJcczd+BVGzktkvsUH18QNUhP10soqvLN0oV4lyFt7ODFhbC+TgpKrRuZ:6uc8ROQNsP10lqDaHl27OLC+TgpKre
TLSH
T125C45AD9E5A5E1D1FC0DA1FBD22469A937000F920A8DC0AC712FD961CE1366B4FD9F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation spyware stealer

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 55 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	steam_updater.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	steam_updater.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	win_logon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	steam_updater.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	steam_updater.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	chrome_helper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	svc_host.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	svc_host.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	nv_service.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	onedrive_upd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	onedrive_upd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	chrome_helper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	steam_updater.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	nv_service.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	onedrive_upd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	onedrive_upd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	steam_updater.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	svc_host.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	win_logon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	chrome_helper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	nv_service.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	nv_service.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	win_logon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	nv_service.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	chrome_helper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	svc_host.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	chrome_helper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	onedrive_upd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	nv_service.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	chrome_helper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	nv_service.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	onedrive_upd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	win_logon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	win_logon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	chrome_helper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	chrome_helper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	svc_host.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	chrome_helper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	win_logon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	steam_updater.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	onedrive_upd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	svc_host.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	chrome_helper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	win_logon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	nv_service.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	win_logon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	win_logon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	onedrive_upd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	win_logon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	win_logon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	nv_service.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	svc_host.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	steam_updater.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	steam_updater.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk	nv_service.exe

Executes dropped EXE 64 IoCs

pid	Process
5004	win_logon.exe
1372	win_logon.exe
4076	svc_host.exe
3776	svc_host.exe
1732	chrome_helper.exe
840	chrome_helper.exe
3596	win_logon.exe
1176	win_logon.exe
3336	nv_service.exe
2688	nv_service.exe
3204	nv_service.exe
1756	win_logon.exe
1796	win_logon.exe
4564	svc_host.exe
5024	nv_service.exe
2420	steam_updater.exe
4268	svc_host.exe
5664	nv_service.exe
3248	svc_host.exe
1288	nv_service.exe
2588	steam_updater.exe
2548	steam_updater.exe
5452	onedrive_upd.exe
2304	onedrive_upd.exe
5524	onedrive_upd.exe
4864	win_logon.exe
4792	onedrive_upd.exe
2580	nv_service.exe
3276	win_logon.exe
4592	chrome_helper.exe
3320	svc_host.exe
5948	win_logon.exe
1008	steam_updater.exe
3296	chrome_helper.exe
4296	nv_service.exe
4312	steam_updater.exe
3560	win_logon.exe
3824	win_logon.exe
6136	steam_updater.exe
4232	onedrive_upd.exe
416	chrome_helper.exe
1772	steam_updater.exe
2124	steam_updater.exe
4964	onedrive_upd.exe
5568	steam_updater.exe
5320	onedrive_upd.exe
6280	svc_host.exe
6300	svc_host.exe
6288	win_logon.exe
6388	win_logon.exe
6424	steam_updater.exe
6492	nv_service.exe
6524	nv_service.exe
6960	onedrive_upd.exe
7036	chrome_helper.exe
7084	onedrive_upd.exe
6060	onedrive_upd.exe
3404	nv_service.exe
6592	chrome_helper.exe
2000	onedrive_upd.exe
2756	svc_host.exe
4852	chrome_helper.exe
1244	onedrive_upd.exe
6988	onedrive_upd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 61 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\NVIDIA\\DisplayDriver\\nv_service.exe"	onedrive_upd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Windows\\Telemetry\\nv_service.exe"	nv_service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\svc_host.exe"	svc_host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\svc_host.exe"	svc_host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\DisplayDriver\\win_logon.exe"	svc_host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Adobe\\Common\\IPC\\win_logon.exe"	chrome_helper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\win_logon.exe"	win_logon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\NVIDIA\\DisplayDriver\\svc_host.exe"	nv_service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\DisplayDriver\\chrome_helper.exe"	win_logon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Intel\\Graphics\\ShaderCache\\win_logon.exe"	chrome_helper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\win_logon.exe"	steam_updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\UserData\\nv_service.exe"	nv_service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\steam_updater.exe"	steam_updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Intel\\Graphics\\ShaderCache\\svc_host.exe"	win_logon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\nv_service.exe"	chrome_helper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Adobe\\Common\\IPC\\win_logon.exe"	win_logon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\nv_service.exe"	chrome_helper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Adobe\\Common\\IPC\\steam_updater.exe"	nv_service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Common\\IPC\\nv_service.exe"	nv_service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\DisplayDriver\\nv_service.exe"	steam_updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Intel\\Graphics\\ShaderCache\\chrome_helper.exe"	onedrive_upd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\DisplayDriver\\win_logon.exe"	win_logon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Intel\\Graphics\\ShaderCache\\onedrive_upd.exe"	steam_updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\onedrive_upd.exe"	onedrive_upd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\steam_updater.exe"	steam_updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\OneDrive\\Update\\win_logon.exe"	2026-08-04_3163a0dcd552b4942ed0a04794dd4a77_conti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\svc_host.exe"	svc_host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\win_logon.exe"	win_logon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\DisplayDriver\\svc_host.exe"	nv_service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Telemetry\\svc_host.exe"	svc_host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Common\\IPC\\onedrive_upd.exe"	onedrive_upd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\OneDrive\\Update\\steam_updater.exe"	svc_host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Adobe\\Common\\IPC\\svc_host.exe"	svc_host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Common\\IPC\\nv_service.exe"	svc_host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Google\\Chrome\\UserData\\win_logon.exe"	win_logon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Intel\\Graphics\\ShaderCache\\win_logon.exe"	steam_updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Common\\IPC\\onedrive_upd.exe"	svc_host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Adobe\\Common\\IPC\\onedrive_upd.exe"	chrome_helper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Adobe\\Common\\IPC\\steam_updater.exe"	chrome_helper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Common\\IPC\\chrome_helper.exe"	win_logon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\chrome_helper.exe"	win_logon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\win_logon.exe"	chrome_helper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Adobe\\Common\\IPC\\nv_service.exe"	nv_service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\OneDrive\\Update\\chrome_helper.exe"	steam_updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\OneDrive\\Update\\win_logon.exe"	win_logon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Windows\\Telemetry\\win_logon.exe"	nv_service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Intel\\Graphics\\ShaderCache\\onedrive_upd.exe"	steam_updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Windows\\Telemetry\\nv_service.exe"	win_logon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\DisplayDriver\\onedrive_upd.exe"	onedrive_upd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\chrome_helper.exe"	steam_updater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Google\\Chrome\\UserData\\onedrive_upd.exe"	nv_service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\UserData\\onedrive_upd.exe"	nv_service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Intel\\Graphics\\ShaderCache\\nv_service.exe"	onedrive_upd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Telemetry\\svc_host.exe"	svc_host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Adobe\\Common\\IPC\\win_logon.exe"	chrome_helper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Adobe\\Common\\IPC\\svc_host.exe"	onedrive_upd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\DisplayDriver\\nv_service.exe"	nv_service.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\chrome_helper.exe"	chrome_helper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\Telemetry\\win_logon.exe"	onedrive_upd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\onedrive_upd.exe"	win_logon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDrive Update = "C:\\Users\\Admin\\AppData\\Local\\Windows\\Telemetry\\svc_host.exe"	chrome_helper.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5664 set thread context of 3564	5664	nv_service.exe	336

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\debug.txt	chrome_helper.exe
File opened for modification	C:\Windows\debug.txt	win_logon.exe
File opened for modification	C:\Windows\debug.txt	win_logon.exe
File opened for modification	C:\Windows\debug.txt	chrome_helper.exe
File opened for modification	C:\Windows\debug.txt	onedrive_upd.exe
File opened for modification	C:\Windows\botnet.txt	nv_service.exe
File opened for modification	C:\Windows\debug.txt	chrome_helper.exe
File opened for modification	C:\Windows\debug.txt	nv_service.exe
File opened for modification	C:\Windows\debug.txt	chrome_helper.exe
File opened for modification	C:\Windows\debug.txt	nv_service.exe
File opened for modification	C:\Windows\debug.txt	chrome_helper.exe
File opened for modification	C:\Windows\debug.txt	nv_service.exe
File opened for modification	C:\Windows\debug.txt	onedrive_upd.exe
File opened for modification	C:\Windows\debug.txt	chrome_helper.exe
File opened for modification	C:\Windows\debug.txt	steam_updater.exe
File opened for modification	C:\Windows\debug.txt	onedrive_upd.exe
File opened for modification	C:\Windows\debug.txt	nv_service.exe
File opened for modification	C:\Windows\debug.txt	nv_service.exe
File opened for modification	C:\Windows\debug.txt	svc_host.exe
File opened for modification	C:\Windows\debug.txt	chrome_helper.exe
File opened for modification	C:\Windows\debug.txt	nv_service.exe
File opened for modification	C:\Windows\debug.txt	svc_host.exe
File opened for modification	C:\Windows\debug.txt	nv_service.exe
File opened for modification	C:\Windows\debug.txt	steam_updater.exe
File opened for modification	C:\Windows\debug.txt	onedrive_upd.exe
File created	C:\Windows\debug.txt	win_logon.exe
File opened for modification	C:\Windows\debug.txt	steam_updater.exe
File opened for modification	C:\Windows\debug.txt	svc_host.exe
File opened for modification	C:\Windows\debug.txt	onedrive_upd.exe
File opened for modification	C:\Windows\debug.txt	nv_service.exe
File opened for modification	C:\Windows\debug.txt	chrome_helper.exe
File opened for modification	C:\Windows\debug.txt	win_logon.exe
File opened for modification	C:\Windows\debug.txt	onedrive_upd.exe
File opened for modification	C:\Windows\debug.txt	chrome_helper.exe
File opened for modification	C:\Windows\debug.txt	win_logon.exe
File opened for modification	C:\Windows\debug.txt	onedrive_upd.exe
File opened for modification	C:\Windows\debug.txt	svc_host.exe
File opened for modification	C:\Windows\debug.txt	nv_service.exe
File opened for modification	C:\Windows\debug.txt	onedrive_upd.exe
File opened for modification	C:\Windows\debug.txt	nv_service.exe
File opened for modification	C:\Windows\debug.txt	chrome_helper.exe
File opened for modification	C:\Windows\debug.txt	win_logon.exe
File opened for modification	C:\Windows\debug.txt	chrome_helper.exe
File opened for modification	C:\Windows\debug.txt	onedrive_upd.exe
File opened for modification	C:\Windows\debug.txt	win_logon.exe
File opened for modification	C:\Windows\debug.txt	svc_host.exe
File opened for modification	C:\Windows\debug.txt	steam_updater.exe
File opened for modification	C:\Windows\debug.txt	steam_updater.exe
File opened for modification	C:\Windows\debug.txt	win_logon.exe
File opened for modification	C:\Windows\debug.txt	onedrive_upd.exe
File opened for modification	C:\Windows\debug.txt	nv_service.exe
File opened for modification	C:\Windows\debug.txt	onedrive_upd.exe
File opened for modification	C:\Windows\botnet.txt	nv_service.exe
File opened for modification	C:\Windows\debug.txt	svc_host.exe
File opened for modification	C:\Windows\debug.txt	svc_host.exe
File opened for modification	C:\Windows\debug.txt	win_logon.exe
File opened for modification	C:\Windows\debug.txt	win_logon.exe
File opened for modification	C:\Windows\debug.txt	chrome_helper.exe
File opened for modification	C:\Windows\debug.txt	win_logon.exe
File opened for modification	C:\Windows\debug.txt	svc_host.exe
File opened for modification	C:\Windows\debug.txt	nv_service.exe
File opened for modification	C:\Windows\debug.txt	nv_service.exe
File opened for modification	C:\Windows\debug.txt	chrome_helper.exe
File opened for modification	C:\Windows\debug.txt	win_logon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 5004	2832	2026-08-04_3163a0dcd552b4942ed0a04794dd4a77_conti.exe	92
PID 5004 wrote to memory of 4076	5004	win_logon.exe	97
PID 1372 wrote to memory of 1732	1372	win_logon.exe	100
PID 840 wrote to memory of 3596	840	chrome_helper.exe	103
PID 1732 wrote to memory of 2688	1732	chrome_helper.exe	109
PID 2688 wrote to memory of 3204	2688	nv_service.exe	111
PID 3596 wrote to memory of 1796	3596	win_logon.exe	118
PID 3776 wrote to memory of 4268	3776	svc_host.exe	126
PID 3336 wrote to memory of 2588	3336	nv_service.exe	131
PID 2588 wrote to memory of 2304	2588	steam_updater.exe	139
PID 2548 wrote to memory of 5524	2548	steam_updater.exe	140
PID 1756 wrote to memory of 2580	1756	win_logon.exe	145
PID 1288 wrote to memory of 3276	1288	nv_service.exe	147
PID 3204 wrote to memory of 3320	3204	nv_service.exe	151
PID 1176 wrote to memory of 5948	1176	win_logon.exe	153
PID 5024 wrote to memory of 1008	5024	nv_service.exe	158
PID 3296 wrote to memory of 3824	3296	chrome_helper.exe	167
PID 5524 wrote to memory of 416	5524	onedrive_upd.exe	171
PID 4792 wrote to memory of 1772	4792	onedrive_upd.exe	173
PID 4864 wrote to memory of 2124	4864	win_logon.exe	177
PID 1796 wrote to memory of 5320	1796	win_logon.exe	181
PID 3248 wrote to memory of 6280	3248	svc_host.exe	185
PID 2124 wrote to memory of 6288	2124	steam_updater.exe	186
PID 6136 wrote to memory of 6424	6136	steam_updater.exe	191
PID 4076 wrote to memory of 6492	4076	svc_host.exe	193
PID 2304 wrote to memory of 6524	2304	onedrive_upd.exe	195
PID 6300 wrote to memory of 6960	6300	svc_host.exe	202
PID 4592 wrote to memory of 7036	4592	chrome_helper.exe	204
PID 4268 wrote to memory of 6592	4268	svc_host.exe	210
PID 3560 wrote to memory of 2000	3560	win_logon.exe	212
PID 5664 wrote to memory of 3564	5664	nv_service.exe	336
PID 4296 wrote to memory of 6988	4296	nv_service.exe	224
PID 6388 wrote to memory of 1780	6388	win_logon.exe	228
PID 6060 wrote to memory of 7396	6060	onedrive_upd.exe	236
PID 5664 wrote to memory of 3564	5664	nv_service.exe	336
PID 5664 wrote to memory of 3564	5664	nv_service.exe	336
PID 5664 wrote to memory of 3564	5664	nv_service.exe	336
PID 5664 wrote to memory of 3564	5664	nv_service.exe	336
PID 5664 wrote to memory of 3564	5664	nv_service.exe	336
PID 5664 wrote to memory of 3564	5664	nv_service.exe	336
PID 5664 wrote to memory of 3564	5664	nv_service.exe	336
PID 5664 wrote to memory of 3564	5664	nv_service.exe	336
PID 5664 wrote to memory of 3564	5664	nv_service.exe	336
PID 5664 wrote to memory of 3564	5664	nv_service.exe	336
PID 5664 wrote to memory of 3564	5664	nv_service.exe	336
PID 7084 wrote to memory of 7480	7084	onedrive_upd.exe	239
PID 6960 wrote to memory of 7600	6960	onedrive_upd.exe	242
PID 4852 wrote to memory of 7752	4852	chrome_helper.exe	246
PID 4312 wrote to memory of 7868	4312	steam_updater.exe	248
PID 7328 wrote to memory of 7996	7328	win_logon.exe	251
PID 5552 wrote to memory of 8016	5552	svc_host.exe	252
PID 4564 wrote to memory of 8128	4564	svc_host.exe	255
PID 4232 wrote to memory of 6232	4232	onedrive_upd.exe	260
PID 6524 wrote to memory of 6056	6524	nv_service.exe	265
PID 7760 wrote to memory of 5124	7760	chrome_helper.exe	267
PID 2420 wrote to memory of 2364	2420	steam_updater.exe	272
PID 7424 wrote to memory of 7016	7424	chrome_helper.exe	278
PID 3320 wrote to memory of 7032	3320	svc_host.exe	279
PID 8064 wrote to memory of 7112	8064	svc_host.exe	285
PID 4964 wrote to memory of 6848	4964	onedrive_upd.exe	288
PID 1008 wrote to memory of 600	1008	steam_updater.exe	291
PID 1772 wrote to memory of 6160	1772	steam_updater.exe	293
PID 6840 wrote to memory of 7792	6840	chrome_helper.exe	296
PID 3276 wrote to memory of 7944	3276	win_logon.exe	299

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-04_3163a0dcd552b4942ed0a04794dd4a77_conti.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_3163a0dcd552b4942ed0a04794dd4a77_conti.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\win_logon.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\win_logon.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\svc_host.exe
    "C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\svc_host.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\nv_service.exe
      "C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\nv_service.exe"
      4⤵
      Creates a file in the Startup directory
      Executes dropped EXE
      Adds Run key to start application
      PID:6492
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        5⤵
        
        PID:3412

C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\win_logon.exe
C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\win_logon.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\chrome_helper.exe
  "C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\chrome_helper.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nv_service.exe
    "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nv_service.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Users\Admin\AppData\Local\Adobe\Common\IPC\nv_service.exe
      "C:\Users\Admin\AppData\Local\Adobe\Common\IPC\nv_service.exe"
      4⤵
      Creates a file in the Startup directory
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3204
    - - C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\svc_host.exe
        
        "C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\svc_host.exe"
        5⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3320
      - C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\onedrive_upd.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\onedrive_upd.exe"
        6⤵
        Drops file in Windows directory
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\steam_updater.exe
        
        "C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\steam_updater.exe"
        7⤵
        
        PID:8748
        
        C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        8⤵
        
        PID:7204

C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\svc_host.exe
C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\svc_host.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\svc_host.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\svc_host.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4268
- - C:\Users\Admin\AppData\Roaming\Windows\Telemetry\chrome_helper.exe
    "C:\Users\Admin\AppData\Roaming\Windows\Telemetry\chrome_helper.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    PID:6592
  - - C:\Users\Admin\AppData\Local\Adobe\Common\IPC\win_logon.exe
      "C:\Users\Admin\AppData\Local\Adobe\Common\IPC\win_logon.exe"
      4⤵
      PID:7664
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        5⤵
        
        PID:8888

C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\chrome_helper.exe
C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\chrome_helper.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:840
- C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\win_logon.exe
  "C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\win_logon.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\win_logon.exe
    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\win_logon.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\onedrive_upd.exe
      "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\onedrive_upd.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:5320
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        5⤵
        
        PID:4676

C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\win_logon.exe
C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\win_logon.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\win_logon.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\win_logon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:5948
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:6784

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nv_service.exe
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nv_service.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Adobe\Common\IPC\steam_updater.exe
  "C:\Users\Admin\AppData\Local\Adobe\Common\IPC\steam_updater.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\onedrive_upd.exe
    "C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\onedrive_upd.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\nv_service.exe
      "C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\nv_service.exe"
      4⤵
      Creates a file in the Startup directory
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:6524
    - - C:\Users\Admin\AppData\Local\Google\Chrome\UserData\onedrive_upd.exe
        
        "C:\Users\Admin\AppData\Local\Google\Chrome\UserData\onedrive_upd.exe"
        5⤵
        Adds Run key to start application
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Adobe\Common\IPC\svc_host.exe
        
        "C:\Users\Admin\AppData\Local\Adobe\Common\IPC\svc_host.exe"
        6⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\svc_host.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\svc_host.exe"
        7⤵
        
        PID:8364
        
        C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        8⤵
        
        PID:6548

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\win_logon.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\win_logon.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Google\Chrome\UserData\nv_service.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\UserData\nv_service.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  PID:2580
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:1284

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\svc_host.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\svc_host.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\svc_host.exe
  "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\svc_host.exe"
  2⤵
  - Drops file in Windows directory
  PID:8128
- - C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\steam_updater.exe
    "C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\steam_updater.exe"
    3⤵
    PID:4356
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:7052

C:\Users\Admin\AppData\Local\Adobe\Common\IPC\nv_service.exe
C:\Users\Admin\AppData\Local\Adobe\Common\IPC\nv_service.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\steam_updater.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\steam_updater.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Users\Admin\AppData\Local\Adobe\Common\IPC\chrome_helper.exe
    "C:\Users\Admin\AppData\Local\Adobe\Common\IPC\chrome_helper.exe"
    3⤵
    - Creates a file in the Startup directory
    - Drops file in Windows directory
    PID:600
  - - C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\onedrive_upd.exe
      "C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\onedrive_upd.exe"
      4⤵
      PID:4760
    - - C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\svc_host.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\svc_host.exe"
        5⤵
        
        PID:6612
      - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        6⤵
        
        PID:5176

C:\Users\Admin\AppData\Local\Adobe\Common\IPC\steam_updater.exe
C:\Users\Admin\AppData\Local\Adobe\Common\IPC\steam_updater.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\chrome_helper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\chrome_helper.exe"
  2⤵
  - Drops file in Windows directory
  PID:2364
- - C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\onedrive_upd.exe
    "C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\onedrive_upd.exe"
    3⤵
    PID:2072
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:4504

C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\nv_service.exe
C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\nv_service.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5664
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3564

C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\svc_host.exe
C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\svc_host.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\svc_host.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\svc_host.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  PID:6280
- - C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\steam_updater.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\steam_updater.exe"
    3⤵
    PID:1912
  - - C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\steam_updater.exe
      "C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\steam_updater.exe"
      4⤵
      PID:8140
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        5⤵
        
        PID:5476

C:\Users\Admin\AppData\Local\Google\Chrome\UserData\nv_service.exe
C:\Users\Admin\AppData\Local\Google\Chrome\UserData\nv_service.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Local\Windows\Telemetry\win_logon.exe
  "C:\Users\Admin\AppData\Local\Windows\Telemetry\win_logon.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\onedrive_upd.exe
    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\onedrive_upd.exe"
    3⤵
    PID:7944
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:9124

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\steam_updater.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\steam_updater.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\onedrive_upd.exe
  "C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\onedrive_upd.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5524
- - C:\Users\Admin\AppData\Local\Google\Chrome\UserData\chrome_helper.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\UserData\chrome_helper.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:416
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:8248

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\onedrive_upd.exe
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\onedrive_upd.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:5452
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:7536

C:\Users\Admin\AppData\Local\Windows\Telemetry\win_logon.exe
C:\Users\Admin\AppData\Local\Windows\Telemetry\win_logon.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Users\Admin\AppData\Local\Google\Chrome\UserData\steam_updater.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\UserData\steam_updater.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\win_logon.exe
    "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\win_logon.exe"
    3⤵
    - Creates a file in the Startup directory
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    PID:6288
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:2624

C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\onedrive_upd.exe
C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\onedrive_upd.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Users\Admin\AppData\Roaming\Windows\Telemetry\steam_updater.exe
  "C:\Users\Admin\AppData\Roaming\Windows\Telemetry\steam_updater.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\nv_service.exe
    "C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\nv_service.exe"
    3⤵
    PID:6160
  - - C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\win_logon.exe
      "C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\win_logon.exe"
      4⤵
      PID:8548
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        5⤵
        
        PID:3672

C:\Users\Admin\AppData\Local\Google\Chrome\UserData\chrome_helper.exe
C:\Users\Admin\AppData\Local\Google\Chrome\UserData\chrome_helper.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\chrome_helper.exe
  "C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\chrome_helper.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  PID:7036
- - C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\win_logon.exe
    "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\win_logon.exe"
    3⤵
    PID:8656
  - - C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\steam_updater.exe
      "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\steam_updater.exe"
      4⤵
      PID:8952
    - - C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\svc_host.exe
        
        "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\svc_host.exe"
        5⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\onedrive_upd.exe
        
        "C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\onedrive_upd.exe"
        6⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Google\Chrome\UserData\win_logon.exe
        
        "C:\Users\Admin\AppData\Local\Google\Chrome\UserData\win_logon.exe"
        7⤵
        
        PID:4492
        
        C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        8⤵
        
        PID:7400

C:\Users\Admin\AppData\Roaming\Windows\Telemetry\chrome_helper.exe
C:\Users\Admin\AppData\Roaming\Windows\Telemetry\chrome_helper.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\win_logon.exe
  "C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\win_logon.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  PID:3824
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:6636

C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\nv_service.exe
C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\nv_service.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\onedrive_upd.exe
  "C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\onedrive_upd.exe"
  2⤵
  - Executes dropped EXE
  PID:6988
- - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onedrive_upd.exe
    "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onedrive_upd.exe"
    3⤵
    PID:9100
  - - C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\onedrive_upd.exe
      "C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\onedrive_upd.exe"
      4⤵
      PID:2516
    - - C:\Users\Admin\AppData\Local\Windows\Telemetry\onedrive_upd.exe
        
        "C:\Users\Admin\AppData\Local\Windows\Telemetry\onedrive_upd.exe"
        5⤵
        
        PID:4744
      - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        6⤵
        
        PID:8152

C:\Users\Admin\AppData\Roaming\Windows\Telemetry\steam_updater.exe
C:\Users\Admin\AppData\Roaming\Windows\Telemetry\steam_updater.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Users\Admin\AppData\Local\Google\Chrome\UserData\svc_host.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\UserData\svc_host.exe"
  2⤵
  PID:7868
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:6400

C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\win_logon.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\win_logon.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\onedrive_upd.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\onedrive_upd.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2000
- - C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\win_logon.exe
    "C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\win_logon.exe"
    3⤵
    PID:6072
  - - C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\chrome_helper.exe
      "C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\chrome_helper.exe"
      4⤵
      PID:7656
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        5⤵
        
        PID:7708

C:\Users\Admin\AppData\Local\Google\Chrome\UserData\steam_updater.exe
C:\Users\Admin\AppData\Local\Google\Chrome\UserData\steam_updater.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6136
- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\steam_updater.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\steam_updater.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  PID:6424
- - C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\onedrive_upd.exe
    "C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\onedrive_upd.exe"
    3⤵
    PID:8792
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:7820

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\onedrive_upd.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\onedrive_upd.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\chrome_helper.exe
  "C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\chrome_helper.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  PID:6232
- - C:\Users\Admin\AppData\Local\Windows\Telemetry\svc_host.exe
    "C:\Users\Admin\AppData\Local\Windows\Telemetry\svc_host.exe"
    3⤵
    PID:1944
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:6620

C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\onedrive_upd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\onedrive_upd.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\onedrive_upd.exe
  "C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\onedrive_upd.exe"
  2⤵
  - Drops file in Windows directory
  PID:6848
- - C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\chrome_helper.exe
    "C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\chrome_helper.exe"
    3⤵
    PID:4368
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:6920

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\steam_updater.exe
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\steam_updater.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
PID:5568
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5784

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\svc_host.exe
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\svc_host.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:6300
- C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\onedrive_upd.exe
  "C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\onedrive_upd.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:6960
- - C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\nv_service.exe
    "C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\nv_service.exe"
    3⤵
    - Drops file in Windows directory
    PID:7600
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:6316

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\win_logon.exe
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\win_logon.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6388
- C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\chrome_helper.exe
  "C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\chrome_helper.exe"
  2⤵
  PID:1780
- - C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\win_logon.exe
    "C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\win_logon.exe"
    3⤵
    PID:8848
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:6656

C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\onedrive_upd.exe
C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\onedrive_upd.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:7084
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\nv_service.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\nv_service.exe"
  2⤵
  - Drops file in Windows directory
  PID:7480
- - C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\svc_host.exe
    "C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\svc_host.exe"
    3⤵
    PID:8776
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:8920

C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\onedrive_upd.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\onedrive_upd.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:6060
- C:\Users\Admin\AppData\Roaming\Windows\Telemetry\win_logon.exe
  "C:\Users\Admin\AppData\Roaming\Windows\Telemetry\win_logon.exe"
  2⤵
  PID:7396
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:8380

C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\nv_service.exe
C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\nv_service.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:3404
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:8756

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\svc_host.exe
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\svc_host.exe
1⤵
- Executes dropped EXE
PID:2756
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3212

C:\Users\Admin\AppData\Local\Adobe\Common\IPC\chrome_helper.exe
C:\Users\Admin\AppData\Local\Adobe\Common\IPC\chrome_helper.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Adobe\Common\IPC\onedrive_upd.exe
  "C:\Users\Admin\AppData\Local\Adobe\Common\IPC\onedrive_upd.exe"
  2⤵
  - Adds Run key to start application
  PID:7752
- - C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\chrome_helper.exe
    "C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\chrome_helper.exe"
    3⤵
    PID:2372
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:8324

C:\Users\Admin\AppData\Local\Google\Chrome\UserData\onedrive_upd.exe
C:\Users\Admin\AppData\Local\Google\Chrome\UserData\onedrive_upd.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1244
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:8432

C:\Users\Admin\AppData\Local\Google\Chrome\UserData\svc_host.exe
C:\Users\Admin\AppData\Local\Google\Chrome\UserData\svc_host.exe
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Users\Admin\AppData\Roaming\Windows\Telemetry\svc_host.exe
  "C:\Users\Admin\AppData\Roaming\Windows\Telemetry\svc_host.exe"
  2⤵
  - Drops file in Windows directory
  PID:8016
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:4568

C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\chrome_helper.exe
C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\chrome_helper.exe
1⤵
- Creates a file in the Startup directory
- Drops file in Windows directory
PID:1748
- C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\chrome_helper.exe
  "C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\chrome_helper.exe"
  2⤵
  PID:4540
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:6308

C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\chrome_helper.exe
C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\chrome_helper.exe
1⤵
PID:7196
- C:\Users\Admin\AppData\Local\Windows\Telemetry\steam_updater.exe
  "C:\Users\Admin\AppData\Local\Windows\Telemetry\steam_updater.exe"
  2⤵
  PID:4300
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:7444

C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\nv_service.exe
C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\nv_service.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:7216
- C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\svc_host.exe
  "C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\svc_host.exe"
  2⤵
  - Drops file in Windows directory
  PID:6588
- - C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\svc_host.exe
    "C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\svc_host.exe"
    3⤵
    PID:7148
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:5884

C:\Users\Admin\AppData\Local\Adobe\Common\IPC\onedrive_upd.exe
C:\Users\Admin\AppData\Local\Adobe\Common\IPC\onedrive_upd.exe
1⤵
PID:7228
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\win_logon.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\win_logon.exe"
  2⤵
  PID:6616
- - C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\steam_updater.exe
    "C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\steam_updater.exe"
    3⤵
    PID:6472
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:5060

C:\Users\Admin\AppData\Roaming\Windows\Telemetry\win_logon.exe
C:\Users\Admin\AppData\Roaming\Windows\Telemetry\win_logon.exe
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:7328
- C:\Users\Admin\AppData\Local\Windows\Telemetry\nv_service.exe
  "C:\Users\Admin\AppData\Local\Windows\Telemetry\nv_service.exe"
  2⤵
  - Drops file in Windows directory
  PID:7996
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:4428

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\nv_service.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\nv_service.exe
1⤵
- Drops file in Windows directory
PID:7340
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4428

C:\Users\Admin\AppData\Local\Windows\Telemetry\nv_service.exe
C:\Users\Admin\AppData\Local\Windows\Telemetry\nv_service.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:7712
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:6692

C:\Users\Admin\AppData\Roaming\Windows\Telemetry\svc_host.exe
C:\Users\Admin\AppData\Roaming\Windows\Telemetry\svc_host.exe
1⤵
- Adds Run key to start application
PID:7728
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:8736

C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\chrome_helper.exe
C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\chrome_helper.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:7424
- C:\Users\Admin\AppData\Local\Adobe\Common\IPC\win_logon.exe
  "C:\Users\Admin\AppData\Local\Adobe\Common\IPC\win_logon.exe"
  2⤵
  PID:7016
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:400

C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\chrome_helper.exe
C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\chrome_helper.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:7760
- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nv_service.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nv_service.exe"
  2⤵
  - Drops file in Windows directory
  PID:5124
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:8556

C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\steam_updater.exe
C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\steam_updater.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:1280
- C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\chrome_helper.exe
  "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\chrome_helper.exe"
  2⤵
  PID:8216
- - C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\svc_host.exe
    "C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\svc_host.exe"
    3⤵
    PID:4772
  - - C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\nv_service.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\nv_service.exe"
      4⤵
      PID:6348
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        5⤵
        
        PID:7236

C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\svc_host.exe
C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\svc_host.exe
1⤵
PID:844
- C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\svc_host.exe
  "C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\svc_host.exe"
  2⤵
  PID:4548
- - C:\Users\Admin\AppData\Local\Adobe\Common\IPC\nv_service.exe
    "C:\Users\Admin\AppData\Local\Adobe\Common\IPC\nv_service.exe"
    3⤵
    PID:5676
  - - C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\chrome_helper.exe
      "C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\chrome_helper.exe"
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\svc_host.exe
        
        "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\svc_host.exe"
        5⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\chrome_helper.exe
        
        "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\chrome_helper.exe"
        6⤵
        
        PID:200
        
        C:\Users\Admin\AppData\Local\Adobe\Common\IPC\chrome_helper.exe
        
        "C:\Users\Admin\AppData\Local\Adobe\Common\IPC\chrome_helper.exe"
        7⤵
        
        PID:4856
        
        C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        8⤵
        
        PID:6248

C:\Users\Admin\AppData\Local\Adobe\Common\IPC\win_logon.exe
C:\Users\Admin\AppData\Local\Adobe\Common\IPC\win_logon.exe
1⤵
- Adds Run key to start application
PID:4424
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:8772

C:\Users\Admin\AppData\Local\Adobe\Common\IPC\svc_host.exe
C:\Users\Admin\AppData\Local\Adobe\Common\IPC\svc_host.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:8144
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4468

C:\Users\Admin\AppData\Local\Windows\Telemetry\svc_host.exe
C:\Users\Admin\AppData\Local\Windows\Telemetry\svc_host.exe
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:8064
- C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\win_logon.exe
  "C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\win_logon.exe"
  2⤵
  - Drops file in Windows directory
  PID:7112
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:6884

C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\win_logon.exe
C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\win_logon.exe
1⤵
- Adds Run key to start application
PID:7184
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1576

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\chrome_helper.exe
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\chrome_helper.exe
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6840
- C:\Users\Admin\AppData\Local\Adobe\Common\IPC\steam_updater.exe
  "C:\Users\Admin\AppData\Local\Adobe\Common\IPC\steam_updater.exe"
  2⤵
  - Creates a file in the Startup directory
  - Adds Run key to start application
  - Drops file in Windows directory
  PID:7792
- - C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\win_logon.exe
    "C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\win_logon.exe"
    3⤵
    PID:4204
  - - C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\steam_updater.exe
      "C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\steam_updater.exe"
      4⤵
      PID:9208
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        5⤵
        
        PID:8968

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\win_logon.exe
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\win_logon.exe
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
PID:2152
- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\chrome_helper.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\chrome_helper.exe"
  2⤵
  - Drops file in Windows directory
  PID:804
- - C:\Users\Admin\AppData\Local\Windows\Telemetry\win_logon.exe
    "C:\Users\Admin\AppData\Local\Windows\Telemetry\win_logon.exe"
    3⤵
    PID:8984
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:6228

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\chrome_helper.exe
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\chrome_helper.exe
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in Windows directory
PID:8188
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:8116

C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\onedrive_upd.exe
C:\Users\Admin\AppData\Roaming\NVIDIA\DisplayDriver\onedrive_upd.exe
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
PID:5992
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:9196

C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\win_logon.exe
C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\win_logon.exe
1⤵
PID:1992
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:8264

C:\Users\Admin\AppData\Local\Windows\Telemetry\steam_updater.exe
C:\Users\Admin\AppData\Local\Windows\Telemetry\steam_updater.exe
1⤵
PID:7316
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:7304

C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\win_logon.exe
C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\win_logon.exe
1⤵
PID:7180
- C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\steam_updater.exe
  "C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\steam_updater.exe"
  2⤵
  PID:9044
- - C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\svc_host.exe
    "C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\svc_host.exe"
    3⤵
    PID:8232
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:1392

C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\svc_host.exe
C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\svc_host.exe
1⤵
PID:2164
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:9184

C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\svc_host.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\svc_host.exe
1⤵
PID:3564
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:1284

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onedrive_upd.exe
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\onedrive_upd.exe
1⤵
PID:2376
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:8388

C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\steam_updater.exe
C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\steam_updater.exe
1⤵
PID:5788
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:8732

C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\steam_updater.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\steam_updater.exe
1⤵
PID:8560
- C:\Users\Admin\AppData\Local\Adobe\Common\IPC\chrome_helper.exe
  "C:\Users\Admin\AppData\Local\Adobe\Common\IPC\chrome_helper.exe"
  2⤵
  PID:1368
- - C:\Users\Admin\AppData\Local\Adobe\Common\IPC\steam_updater.exe
    "C:\Users\Admin\AppData\Local\Adobe\Common\IPC\steam_updater.exe"
    3⤵
    PID:3916
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:4620

C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\win_logon.exe
C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\win_logon.exe
1⤵
PID:8572
- C:\Users\Admin\AppData\Roaming\Windows\Telemetry\nv_service.exe
  "C:\Users\Admin\AppData\Roaming\Windows\Telemetry\nv_service.exe"
  2⤵
  PID:5976
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:8204

C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\chrome_helper.exe
C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\chrome_helper.exe
1⤵
PID:8584
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2888

C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\steam_updater.exe
C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\steam_updater.exe
1⤵
PID:9028
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:3572

C:\Users\Admin\AppData\Roaming\Windows\Telemetry\nv_service.exe
C:\Users\Admin\AppData\Roaming\Windows\Telemetry\nv_service.exe
1⤵
PID:9036
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:7848

C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\svc_host.exe
C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\svc_host.exe
1⤵
PID:8516
- C:\Users\Admin\AppData\Local\Windows\Telemetry\chrome_helper.exe
  "C:\Users\Admin\AppData\Local\Windows\Telemetry\chrome_helper.exe"
  2⤵
  PID:1104
- - C:\Users\Admin\AppData\Local\Adobe\Common\IPC\steam_updater.exe
    "C:\Users\Admin\AppData\Local\Adobe\Common\IPC\steam_updater.exe"
    3⤵
    PID:6864
  - - C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\win_logon.exe
      "C:\Users\Admin\AppData\Local\Intel\Graphics\ShaderCache\win_logon.exe"
      4⤵
      PID:8472
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        5⤵
        
        PID:8116

C:\Users\Admin\AppData\Local\Windows\Telemetry\chrome_helper.exe
C:\Users\Admin\AppData\Local\Windows\Telemetry\chrome_helper.exe
1⤵
PID:6692
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:8268

C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\svc_host.exe
C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\svc_host.exe
1⤵
PID:7200
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:8588

C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\steam_updater.exe
C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\steam_updater.exe
1⤵
PID:9192
- C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\chrome_helper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\chrome_helper.exe"
  2⤵
  PID:9200
- - C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\steam_updater.exe
    "C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\steam_updater.exe"
    3⤵
    PID:1512
  - - C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\onedrive_upd.exe
      "C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\onedrive_upd.exe"
      4⤵
      PID:5828
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        5⤵
        
        PID:6896

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\steam_updater.exe
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\steam_updater.exe
1⤵
PID:1664
- C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\nv_service.exe
  "C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\nv_service.exe"
  2⤵
  PID:8904
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:9176

C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\chrome_helper.exe
C:\Users\Admin\AppData\Roaming\Google\Chrome\UserData\chrome_helper.exe
1⤵
PID:6504
- C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\nv_service.exe
  "C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\nv_service.exe"
  2⤵
  PID:8376
- - C:\Users\Admin\AppData\Local\Google\Chrome\UserData\steam_updater.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\UserData\steam_updater.exe"
    3⤵
    PID:4488
  - - C:\Users\Admin\AppData\Roaming\Windows\Telemetry\chrome_helper.exe
      "C:\Users\Admin\AppData\Roaming\Windows\Telemetry\chrome_helper.exe"
      4⤵
      PID:1632
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        5⤵
        
        PID:8604

C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\nv_service.exe
C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\nv_service.exe
1⤵
PID:2192
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:7524

C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\steam_updater.exe
C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\steam_updater.exe
1⤵
PID:5076
- C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\svc_host.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\svc_host.exe"
  2⤵
  PID:4752
- - C:\Users\Admin\AppData\Local\Adobe\Common\IPC\chrome_helper.exe
    "C:\Users\Admin\AppData\Local\Adobe\Common\IPC\chrome_helper.exe"
    3⤵
    PID:8244
  - - C:\Users\Admin\AppData\Local\Windows\Telemetry\onedrive_upd.exe
      "C:\Users\Admin\AppData\Local\Windows\Telemetry\onedrive_upd.exe"
      4⤵
      PID:4924
    - - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        5⤵
        
        PID:8496

C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\onedrive_upd.exe
C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\onedrive_upd.exe
1⤵
PID:7392
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2712

C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\nv_service.exe
C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\nv_service.exe
1⤵
PID:5284
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:4928

C:\Users\Admin\AppData\Local\Windows\Telemetry\onedrive_upd.exe
C:\Users\Admin\AppData\Local\Windows\Telemetry\onedrive_upd.exe
1⤵
PID:8528
- C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\win_logon.exe
  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\win_logon.exe"
  2⤵
  PID:6320
- - C:\Windows\System32\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    PID:1532

C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\onedrive_upd.exe
C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\onedrive_upd.exe
1⤵
PID:6264
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:2952

C:\Users\Admin\AppData\Local\Google\Chrome\UserData\win_logon.exe
C:\Users\Admin\AppData\Local\Google\Chrome\UserData\win_logon.exe
1⤵
PID:6856
- C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\steam_updater.exe
  "C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\steam_updater.exe"
  2⤵
  PID:4544
- - C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\svc_host.exe
    "C:\Users\Admin\AppData\Local\NVIDIA\DisplayDriver\svc_host.exe"
    3⤵
    PID:5336
  - - C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\svc_host.exe
      "C:\Users\Admin\AppData\Roaming\Intel\Graphics\ShaderCache\svc_host.exe"
      4⤵
      PID:4248
    - - C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\nv_service.exe
        
        "C:\Users\Admin\AppData\Roaming\Adobe\Common\IPC\nv_service.exe"
        5⤵
        
        PID:7416
      - C:\Windows\System32\notepad.exe
        
        "C:\Windows\System32\notepad.exe"
        6⤵
        
        PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

debug.txt

Path C:\Users\Admin\AppData\Local\Temp\debug.txt
Size 57B
SHA256 5cc5d87b1ae6bd827731c7da1489d6b034c56869585266161138efa41361d0e0
MD5 3670c3c4e5257e7ce0c861fa65abc800
SHA1 c7af1fbd63e6d895ef00c65b595bb31a4bfdef46
SHA512 cd49568907413662bcbf8ec21f4c5e2fd5c342a64aa10bea3bb917c7f2bb569c5de13bb22dd09a52f632f7992ed699fca75645aebc38670196f9f6cc2f54839e
TLSH
T17F90029580A862B561F062133260A7D29A8E11174B18D29129E227DF6C5458A1676276
MD5 SHA1 SHA512 TLSH

Submit Download

win_logon.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\OneDrive\Update\win_logon.exe
Size 538KB
SHA256 145d4ac628495ce01eccf5102f30da499460d77b300328b3d6aa90ddc9f980fc
MD5 3163a0dcd552b4942ed0a04794dd4a77
SHA1 07a3a734a846e52ef7cd2748a065c509cd7593c2
SHA512 45c56418eafe7a43266a171eab1a79bfa4420214b10c279544a280f24b64375a84d2fe6c8af04deb8b1eb46294905a6618080a60df6d910feb4997f3770ddb54
SSDEEP 6144:6Nd8uVnIJcczd+BVGzktkvsUH18QNUhP10soqvLN0oV4lyFt7ODFhbC+TgpKrRuZ:6uc8ROQNsP10lqDaHl27OLC+TgpKre
TLSH
T125C45AD9E5A5E1D1FC0DA1FBD22469A937000F920A8DC0AC712FD961CE1366B4FD9F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinHelper.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk
Size 1KB
SHA256 1e360af13d6edab859f4b859f6ced97925dd7a096dfa3b5768717b991665e0f4
MD5 578699869fec58b8f8f68b7189d79bfe
SHA1 8506f3826d88425280a6c67db487df791e8e58fd
SHA512 a48166adfc604944faa06c2649cff8bfaa969746ca92713f6d21e769cc5f1963dde07805de693837acd00cd3cc5867a524f4e504bd8542c42583e982ce2dae09
TLSH
T11E21AB065BCB0F4AE0A348B538B6A27592B3FC81AE569B0E4650A0093860731F86CFC6
MD5 SHA1 SHA512 TLSH

Submit Download

WinHelper.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk
Size 1KB
SHA256 20ea40424dacf2a5995e6469631cc00fda2807775424215f82a2c3ad92252758
MD5 e2cd0c1444dd68bf10b00d7dd5c42e70
SHA1 a6255b03fec9b4125d68c621b3a22745c90f02e1
SHA512 91d92b92954679bcdd47681e8207e66674584be2810cd723cf7dd2b86babe5ae66e708c16ed2f3ec2b453fef60f9a21d33be62f2833a981af86dcc6a8c3165a8
TLSH
T1CD2114064AD72F32E2E4853A2CF76651E2B1FC60AB55DF190050D2481C64712FC5CF2B
MD5 SHA1 SHA512 TLSH

Submit Download

WinHelper.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk
Size 1KB
SHA256 1a5818ae00c3fc22c7c426704511402599b30aacae1a78b6ce5b5a64841380ec
MD5 d82a309aa3d4519980e6a9fd4c6f5359
SHA1 50d07e5d45c255b3e22c92a0569e2fe780eb971b
SHA512 6bc7e9004bce7b1300263b8b2a66e77685b375342ac2c6d62f8af83763eac1d4d01a97a5ff42237b703f0ba7f357f769282f97aeab56a904e936f8d36e236226
TLSH
T1B321CE1A9FC71B22D2A8883638F755269571BCA0AEA9DF190150D28C1C65612FC69F2E
MD5 SHA1 SHA512 TLSH

Submit Download

WinHelper.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk
Size 1KB
SHA256 be7ff03a636afc61da0b22c16689916b3c67ae663c41145fc154bcd21847d273
MD5 8c51e81993e4655fec6a2e4c882cc5ef
SHA1 af97f079997b598b9441f5bc6a4d4daf41ef706f
SHA512 ddbbb07a0c60f4014ec3452feee40e5d18d3e2f056350b102fae41f49a9b3eba47af88b6dd28d3461b99d2fd1679b16f534e0ca3d6e95da8ae24fea279df956b
TLSH
T10321E11A2ECB1B53C2E5847174BB6175D671BC61BBA99F294150E3CC1861302AC1CF3F
MD5 SHA1 SHA512 TLSH

Submit Download

WinHelper.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk
Size 1KB
SHA256 0d8583244a6f346c9d8e517b461fcaf1c2dd01d96ffca448aa1d011dece9dc54
MD5 8c0815da8c5d06e9dc114c4f0164d20d
SHA1 1b5f87770754e59651614d9ea59ef1c637771143
SHA512 ef3358fc9ebfdb00a139497ba49812859def270df7be435ac4179b23c88924beac644884bb77d8cbc1e125943636b9f771e1606a30bed2b998ec3805c37f67d6
TLSH
T17C21C01B1BC71B16C2D485353CFB6667C171FC64DAA1CF5E1151E3441CA4252E918F1F
MD5 SHA1 SHA512 TLSH

Submit Download

WinHelper.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk
Size 1KB
SHA256 44841e40f56192c26b7dbe5c8e68d62f18a30910aaacb6fffd2d584a73908626
MD5 9d84eded1afc4cabe3751d080d225556
SHA1 5ff6ca9314de80d8306035232230526e5e224753
SHA512 63b21d75dd38832918367c802d121c17048f98ecffc559193347a40b60cdc596c254d3858d0fccdb321ef96b319884634843458e4dccaef3eb571c1a53e2f8e8
TLSH
T1F121F1061AC70B15D1E6887A68BF626686B2B812EAD65F0D0060D3481860751FC5CF1F
MD5 SHA1 SHA512 TLSH

Submit Download

WinHelper.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk
Size 1KB
SHA256 1359fb2ae00da50f6620f032d0d60d13ef87e4abfbd0b88b3b0461f6a739cc83
MD5 66240e861012b1065b0153b45da017c2
SHA1 e7606ee2948c87310b477a47d9e8d9aa79ab6da7
SHA512 74f47fe5d1e51311cd57f97b220b3bfb75aabccc995e3bb5400b881fd7f3879b4aa230a5b5b5dab2af0df44bc515f0b629ba9584b6cb04d467f02c1b45102de2
TLSH
T1B221FE1B4BC30B56D1B6C0796CB7626291B5FC61AB968F1C00A1E24A2CB1341ED59E1F
MD5 SHA1 SHA512 TLSH

Submit Download

WinHelper.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinHelper.lnk
Size 1KB
SHA256 3ac04f81de9a58dd90919bba8bb42a2b05a98322184907bbafb4cd79b306330c
MD5 0c6560ee60bfe873dfb76de5d991c017
SHA1 1d91b64edddff0ebe152bd619b84b13530bc8827
SHA512 2ac43456cf192d3ff1ad4c1340530dc08de3a85031d0f16bb0589959daed6200de8a39cfaeac7dddbc288d2fbd2a906c34fa7dec882c81bba2842827deeb1efc
TLSH
T16121F11B4BC30B06D2B5C4756CB7626291B5FC61A7928F1C1091D2462CB1341AC19E1E
MD5 SHA1 SHA512 TLSH

Submit Download

botnet.txt

Path C:\Windows\botnet.txt
Size 3KB
SHA256 d94a6c88ec0637b4e20d92ade7d78aa3676239e86686c3b143b42c6f95e40174
MD5 a9b2d54f6159a03b9f993a394e1ea7c8
SHA1 5a3e652b4d81d185c899e4c72742ed922dfa8a53
SHA512 11c02b2e452a08b3bf45cab13372c965722d90d0e2c07581865525a6eba019b2cf30043c2ef7962ae33a1693eca184d118ce40a5b3e2b0a021f3335ac6a3f53e
TLSH
T12281280536AD2090C44B2B3FB4B02E5DA0D3FD696F8F1414B7B689D99C9AC03DA3EE14
MD5 SHA1 SHA512 TLSH

Submit Download

botnet.txt

Path C:\Windows\botnet.txt
Size 4KB
SHA256 a2c9dab80c2cf0447d00c6efee2e9880eb11c08f86f82cf402a6e6fa9ee5ba33
MD5 133bf6780fc125921a10ee69ccafa705
SHA1 85f8af008fafcb83e02a75dcb6a2845ad685b576
SHA512 c85501aa6dc9d9b305e57d7a4000bbc1e6eeb295fce522d42ca311a4f965587b4ffb80ed53bca5119f370e4ccf9d7e65d264445a9c6d5cb36da7048754391f54
SSDEEP 96:KeLCTLO5jdVIng8YSKi25vpDi/3qtyj2PAP6xxxPoPovHTlqT2TtTuTAVCuVl5D/:4g8Uoi39CqMiZ68suVXOGItAAj2yrI5F
TLSH
T1D4913C0522AD2190C44A1F3FB4B42E5DA0D3FD692F8F5414B7F689D59C9AC03EA3EE14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

botnet_debug.txt

Path C:\Windows\botnet_debug.txt
Size 4KB
SHA256 f1461127af4e5457bf4c2f5ff31df5c29fbb9012f9190fe1819098745c0aefdc
MD5 f3e3d1031640e068bea583ecf3cefff5
SHA1 32e1e2f37b4ff4263dae4dd5566adf80a801800b
SHA512 a7d51156cf59d2f392b04c83cdc43149b281c1440f7858fc6e7a482117faddcef9b6a9fc90959e0a8ea276373afa1cf4c889a81470714198c6d39cb0ff6d7439
SSDEEP 96:KyHDHmZPHpZ6mHn3ZrH4SHlMJHnPIHZdHbKHdGH61HSIHZ+HO5HnfHu0HmgwHvjL:ebf3esiPkVCZQYJlm8ej8AvyrBnHrQt9
TLSH
T195A1600552DD669C6A37363F26B36A8C6173E7852F8A310DFBB084ED50D5C0BFA5A4C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debug.txt

Path C:\Windows\debug.txt
Size 631B
SHA256 df3c899cbdf0717ddf0144fe7b059edc06bcbf5c8dfda6f4971ddf32b305fc1a
MD5 e911a0e099956dd9a44d2012c03738d8
SHA1 28f67d344df4af1c280f5d5cf166fc6ed7f86107
SHA512 e6d82613c85bdb77d2bce54906cd105ce2731cc57e16f62b5606043554e3c9092152a8b53f7139313b1965d10ae33adc87ea52511b3e8c90225c0703fc0a305d
TLSH
T170F09B8541785179D1F1523272605793E54D501A1F0CD25018F231DF18545451237176
MD5 SHA1 SHA512 TLSH

Submit Download

debug.txt

Path C:\Windows\debug.txt
Size 338B
SHA256 1711392ad57d710457ed1a08dea9d4bfd5f75f80bdd2bff1ac8b5a1f27b0cdff
MD5 9baee7b7ef0170837cb14ce43eb221ff
SHA1 4f82996ee30ac8840217340e2acbda37053bcbe1
SHA512 07b27cf0e5220bde7d52d8129fec579993d67102e6551d63f766dcb7c73f96a2a32c533872a123120b90f4450f6ef0e3afad4562a00b6251bddf5abef338f89c
TLSH
T122E0121F86DB955DD90E01BF5DD24398E6714604BF0D390CCF40B02D61D0918EE91210
MD5 SHA1 SHA512 TLSH

Submit Download

debug.txt

Path C:\Windows\debug.txt
Size 1KB
SHA256 8724d4e9e1933dbc640b8d8a3b9040689107935ff6f8d3a3c629755cbf902cd7
MD5 d8fbcf1abadcaa52b84cf59324adf126
SHA1 d8fc6774840fec0bdc971f527cd8241fc1c56dfb
SHA512 6e0b6f3af1b4631b29470039fa1e3383168260a542e95f4e2729733085ece10aa38bda5e51f34a9b4c051d9883774bc1a202da13c3dac7c63aca515bce229889
TLSH
T184119E9246DC429EDB8511D71BE172DACBE92715AF8C2904CF9121AC50C0F2CBAAB1A6
MD5 SHA1 SHA512 TLSH

Submit Download

debug.txt

Path C:\Windows\debug.txt
Size 1KB
SHA256 ce04eb85623b13720ccf51f6e7ea0b6ab34474ddb6473f08724513b6db7ccc8b
MD5 18f4c7f1ae725fef3df7acd7ee6c7295
SHA1 9ed8b3c32941d6aa448434bb55b312a5f3010858
SHA512 10fef6c1bb3a702745b985701fdde196664b866ced358a9b3e2efd3c2b937142afa860602dc95826c7b557411105870dcb1202e2ba857ca0144e3e5b128b515d
TLSH
T12511CE5346DC429EDA8511C71BF171EACBE92726BF9C2904CF5121AC50C0F2CEA7B1A6
MD5 SHA1 SHA512 TLSH

Submit Download

debug.txt

Path C:\Windows\debug.txt
Size 232B
SHA256 047880157f0d6287908664e613f00b3119dc64d063eb9a3fbce0c9f02707d796
MD5 2328f1f2d014872ce96dc1b1e612cb9b
SHA1 8b527b6119a82c7443a1ac58f9bd93977d870bb6
SHA512 c4d732e69f552b37c479bb7f7b87c1b14ed957027d4130cdaaafd78e8869f4423d9c5802ecc9dae8ec8889e9c568531cb89d6e65362a18bf541dcb309a3b82b7
TLSH
T124D08007406481DDD55655BF47935644A1F601CA2F0C3114DF42705C30C49CC6AD70DE
MD5 SHA1 SHA512 TLSH

Submit Download

debug.txt

Path C:\Windows\debug.txt
Size 538B
SHA256 ffa62324c6c7e759ba007843903af5d269f2cb321bc681b2958cdaf4b1a58034
MD5 91797668d3f3025d051f7f7c002e63e8
SHA1 405c7a745839a231950ff9d4063d47b4451d1e17
SHA512 323a7451cacf1314cb878b36fbc5b5717e4171ad23f645bb89715a4c8dc0aaa52ea3407cf89083302e4bcc9794672a989e88e022d48dc2dfc176198cf95123fd
TLSH
T130F080418095D529D050713F11A097C1D2AD01074F1C6640175021AD15C568DA5A73D3
MD5 SHA1 SHA512 TLSH

Submit Download

debug.txt

Path C:\Windows\debug.txt
Size 522B
SHA256 d222367e926b306835551628617ab4b059045849373acfa7d86ab185fdfc75ce
MD5 3d4b9dd6e8003277a8661b13e4d5619d
SHA1 f79b4e3720b5b95276ada76d7eefba6875b15c51
SHA512 adec442bcdae5bb252e9ea8241733eb38ea853f0feb9ac2b0c53e8818c7c9a4d209fefdba12684a9de056049475d98ebe8a2cfbb6ebcdb12039c0f10d1151bc2
TLSH
T1A3F0120048CFC40AC38401BB0DD55046C1550B042F4E270047806AFC1193A4EE8DFA4D
MD5 SHA1 SHA512 TLSH

Submit Download

debug.txt

Path C:\Windows\debug.txt
Size 338B
SHA256 4dad7552b309e6197a55851beb64d07fbd530540510f3c3f9da85adc23eed3dc
MD5 bfd8f94689ab6736ce0fe42f60611c4b
SHA1 ae996c57c279b1c8f2e5d5120fc11ccbd27e6f50
SHA512 d7decfba40d307462b204cbe945a71b6d55666ac11e8d349a0ce169639a67cb3f9ba3d0f2e20770cc7f44635e7c8caf7552f139cea47ccc619b245165e74fd5e
TLSH
T171E0970240A8266DE090433322A0E3C4DAAD02044F1C5245AA8232AD20C488C3AF3368
MD5 SHA1 SHA512 TLSH

Submit Download

memory/416-174-0x00007FF705520000-0x00007FF7055AE000-memory.dmp

Download

memory/840-16-0x00007FF7EFCC0000-0x00007FF7EFD4E000-memory.dmp

Download

memory/1008-149-0x00007FF7E4080000-0x00007FF7E410E000-memory.dmp

Download

memory/1176-82-0x00007FF611600000-0x00007FF61168E000-memory.dmp

Download

memory/1288-78-0x00007FF7A1840000-0x00007FF7A18CE000-memory.dmp

Download

memory/1372-12-0x00007FF62A040000-0x00007FF62A0CE000-memory.dmp

Download

memory/1732-25-0x00007FF7EFCC0000-0x00007FF7EFD4E000-memory.dmp

Download

memory/1756-88-0x00007FF6DB290000-0x00007FF6DB31E000-memory.dmp

Download

memory/1772-175-0x00007FF7658C0000-0x00007FF76594E000-memory.dmp

Download

memory/1796-110-0x00007FF6DB290000-0x00007FF6DB31E000-memory.dmp

Download

memory/1796-106-0x00007FF6DB290000-0x00007FF6DB31E000-memory.dmp

Download

memory/2124-114-0x00007FF635C90000-0x00007FF635D1E000-memory.dmp

Download

memory/2304-105-0x00007FF678DF0000-0x00007FF678E7E000-memory.dmp

Download

memory/2420-108-0x00007FF759DE0000-0x00007FF759E6E000-memory.dmp

Download

memory/2548-86-0x00007FF7E4080000-0x00007FF7E410E000-memory.dmp

Download

memory/2580-134-0x00007FF7A1840000-0x00007FF7A18CE000-memory.dmp

Download

memory/2588-83-0x00007FF759DE0000-0x00007FF759E6E000-memory.dmp

Download

memory/2688-63-0x00007FF7D8D60000-0x00007FF7D8DEE000-memory.dmp

Download

memory/2832-3-0x00007FF7438E0000-0x00007FF74396E000-memory.dmp

Download

memory/3204-90-0x00007FF6AF330000-0x00007FF6AF3BE000-memory.dmp

Download

memory/3248-104-0x00007FF6E5BA0000-0x00007FF6E5C2E000-memory.dmp

Download

memory/3276-135-0x00007FF619540000-0x00007FF6195CE000-memory.dmp

Download

memory/3296-93-0x00007FF6C2EF0000-0x00007FF6C2F7E000-memory.dmp

Download

memory/3320-140-0x00007FF6E5BA0000-0x00007FF6E5C2E000-memory.dmp

Download

memory/3336-56-0x00007FF7D8D60000-0x00007FF7D8DEE000-memory.dmp

Download

memory/3560-156-0x00007FF7CF7E0000-0x00007FF7CF86E000-memory.dmp

Download

memory/3564-144-0x0000000140000000-0x000000014008E000-memory.dmp

Download

memory/3596-66-0x00007FF611600000-0x00007FF61168E000-memory.dmp

Download

memory/3776-71-0x00007FF782950000-0x00007FF7829DE000-memory.dmp

Download

memory/3824-162-0x00007FF7CF7E0000-0x00007FF7CF86E000-memory.dmp

Download

memory/4076-98-0x00007FF782950000-0x00007FF7829DE000-memory.dmp

Download

memory/4076-103-0x00007FF782950000-0x00007FF7829DE000-memory.dmp

Download

memory/4232-173-0x00007FF7BA880000-0x00007FF7BA90E000-memory.dmp

Download

memory/4268-133-0x00007FF673F80000-0x00007FF67400E000-memory.dmp

Download

memory/4268-115-0x00007FF673F80000-0x00007FF67400E000-memory.dmp

Download

memory/4296-163-0x00007FF7A0AE0000-0x00007FF7A0B6E000-memory.dmp

Download

memory/4296-150-0x00007FF7A0AE0000-0x00007FF7A0B6E000-memory.dmp

Download

memory/4312-151-0x00007FF7658C0000-0x00007FF76594E000-memory.dmp

Download

memory/4312-161-0x00007FF7658C0000-0x00007FF76594E000-memory.dmp

Download

memory/4564-169-0x00007FF673F80000-0x00007FF67400E000-memory.dmp

Download

memory/4564-107-0x00007FF673F80000-0x00007FF67400E000-memory.dmp

Download

memory/4592-152-0x00007FF705520000-0x00007FF7055AE000-memory.dmp

Download

memory/4592-139-0x00007FF705520000-0x00007FF7055AE000-memory.dmp

Download

memory/4792-97-0x00007FF678DF0000-0x00007FF678E7E000-memory.dmp

Download

memory/4864-102-0x00007FF619540000-0x00007FF6195CE000-memory.dmp

Download

memory/5004-5-0x00007FF62A040000-0x00007FF62A0CE000-memory.dmp

Download

memory/5024-87-0x00007FF6AF330000-0x00007FF6AF3BE000-memory.dmp

Download

memory/5452-120-0x00007FF768940000-0x00007FF7689CE000-memory.dmp

Download

memory/5452-171-0x00007FFE89B40000-0x00007FFE89DA3000-memory.dmp

Download

memory/5524-99-0x00007FF678DF0000-0x00007FF678E7E000-memory.dmp

Download

memory/5552-166-0x00007FF6AB810000-0x00007FF6AB89E000-memory.dmp

Download

memory/5664-121-0x0000000140000000-0x0000000140030000-memory.dmp

Download

memory/5664-155-0x00007FF789B20000-0x00007FF789BAE000-memory.dmp

Download

memory/5664-154-0x0000000140000000-0x0000000140030000-memory.dmp

Download

memory/5664-122-0x00007FFE89B40000-0x00007FFE89DA3000-memory.dmp

Download

memory/5664-116-0x00007FF789B20000-0x00007FF789BAE000-memory.dmp

Download

memory/5948-141-0x00007FF6CFD90000-0x00007FF6CFE1E000-memory.dmp

Download

memory/6060-176-0x00007FF635F10000-0x00007FF635F9E000-memory.dmp

Download

memory/6136-113-0x00007FF635C90000-0x00007FF635D1E000-memory.dmp

Download

memory/6300-148-0x00007FF783600000-0x00007FF78368E000-memory.dmp

Download

memory/6388-164-0x00007FF7D6180000-0x00007FF7D620E000-memory.dmp

Download

memory/6960-168-0x00007FF7F3EA0000-0x00007FF7F3F2E000-memory.dmp

Download

memory/7084-177-0x00007FF7F3EA0000-0x00007FF7F3F2E000-memory.dmp

Download

memory/7328-167-0x00007FF608A70000-0x00007FF608AFE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads